Assurance Level Requirement (draft)
Results
| Assessor | Activity | ||
|---|---|---|---|
| Department | Date |
| Criteria | Required Level | Assessment | Potential Harm | Rationale |
|---|---|---|---|---|
| 1. Inconvenience, distress, loss of standing or reputation |
1
2
3
4
N/A
|
An inconvenience, distress or damage to the standing or reputation of any party A serious short-term or a limited long-term inconvenience, distress or damage to the standing or reputation of any party A serious long-term inconvenience, distress or damage to the standing or reputation of any party A severe and permanent inconvenience, distress or damageto the standing or reputation of any party
|
|
|
| 2. Financial loss |
1
2
3
4
N/A
|
A financial loss A minor financial loss to any party (Note: The severity of the loss depends on the impact of the loss on the affected party) A major financial loss to any party (Note: The severity of the loss depends on the impact of the loss on the affected party) An extreme financial loss to any party (Note: The severity of the loss depends on the impact of the loss on the affected party)
|
|
|
| 3. Harm to program or to public interest |
1
2
3
4
N/A
|
An adverse effect on any government organization, program, asset or the public interest A limited adverse effect on a government organization (i.e., it can perform its primary function but with reduced effectiveness), program, organizational asset or the public interest A serious adverse effect on a government organization (i.e., it can perform its primary function with significantly reduced effectiveness), program, organizational asset or the public interest A catastrophic effect on a government organization (i.e., it is unable to perform its primary function), program, organizational asset or the public interest
|
|
|
| 4. Unauthorized release of sensitive personal or commercial information |
1
2
3
4
N/A
|
A loss of personal privacy or breach of personal or commercial information A limited adverse effect on an individual or institution due to the loss of confidentiality or breach of privacy resulting from unauthorized release or improper disclosure of sensitive personal or commercial information A serious adverse effect on an individual or institution due to the loss of confidentiality or breach of privacy resulting from unauthorized release or improper disclosure of sensitive personal or commercial information A catastrophic effect on an individual or institution due to the loss of confidentiality or breach of privacy resulting from unauthorized release or improper disclosure of sensitive personal or commercial information
|
|
|
| 5. Unauthorized release of sensitive government information (non-personal information) |
1
2
3
4
N/A
|
A loss of confidentiality A limited adverse effect on organizational operations and assets due to a loss of confidentiality resulting from the release of sensitive government information to unauthorized parties A serious adverse effect on organizational operations and assets due to a loss of confidentiality resulting from the release of sensitive government information to unauthorized parties A catastrophic effect on organizational operations and assets due to a loss of confidentiality resulting from the release of sensitive government information to unauthorized parties
|
|
|
| 6. Civil or criminal violations |
1
2
3
4
N/A
|
A violation that may have minor consequences A violation that may have serious consequences A violation that may have exceptionally grave consequences
|
|
|
| 7. Personal health and safety |
1
2
3
4
N/A
|
A minor personal injury not requiring medical attention A personal injury requiring medical attention A serious personal injury or death
|
|
|
| 8. National interest |
1
2
3
4
N/A
|
A disadvantage to the national interest An injury to the national interest A serious or exceptionally grave injury to the national interest
|
|
|
| Overall Assessment |
1
1
|
If the program, activity, service or transaction above is compromised, it could reasonably be expected to cause NO to MINIMAL harm.
|
||
| Assessment Version 1.0 | ||||
Afterwards
The following table outlines what departments should do when a selected authentication option is equal to the assurance level requirement determined above and when the selected option is lower than the assurance level requirement determined above.
| Authentication Option | Implementation Option | |
|---|---|---|
| Within the Department | Rely On Another Party | |
| Equal to assurance level requirement |
|
If participant in federation:
|
| Lower than assurance level requirement |
|
If participant in federation:
|