# Authentication Level Reference

LevelDescription:
Little or no confidence exists in the asserted identity.  For example, level 1 credentials allow people to bookmark items on a web page for future reference.

Examples1:
(1)  In some instances, the submission of forms by individuals in an electronic transaction will be a level 1 transaction: (i) when all information is flowing to the Federal organization from the individual, (ii) there is no release of information in return, and (iii) the criteria for higher assurance levels are not triggered.  For example, if an individual applies to a Federal agency for an annual park visitor's permit (and the financial aspects of the transaction are handled by a separate contractor and thus analyzed as a separate transaction) the transaction with the Federal agency would otherwise present minimal risks and could be treated as Level 1.

Examples2:
(2)  A user participates in an online discussion on the whitehouse.gov website, which does not request identifying information beyond name and location.  Assuming the forum doesn't address sensitive or private information, there are no obvious inherent risks.

Examples3:
(3)  A user participats in an online discussion on the whitehouse.gov website, which does not request identifying information beyond name and location.  Assuming the forum does not address sensitive or private information, there are no obvious inherent risks.


LevelDescription:
On balance, confidence exists that the asserted identity is accurate.  Level 2 credentials are appropriate for a wide range of business with the public where agencies require an initial identity assertion (the details of which are verified independently prior to any Federal action).

Examples1:
(1)  A user subscribes to the Gov Online Learning Center (www.golearn.gov).  The site's training service must authenticate the person to present the approprate course material, assign grades, or demonstrate that the user has satisfied compensation-or-promotion-related training requirements.  The only risk associated with this transaction is a third party gaining access to grading information, thereby harming the student's privacy or reputation.  If the agency determines that such harm is minor, the transaction is Level 2.

Examples2:
(2)  A beneficiary changes her address of record through the Social Security web site.  The site needs authentication to ensure that the person's address is changed.  Since official notices regarding payment amounts, account status, and records of changes are sent to the beneficiary's address of record, it entails moderate risk of unauthorized release of information.  The agency detemines that the risk of unauthorized release merits Level 2 authentication.

Examples3:
(3)  An agency program client updates bank account, program eligibility, or payment information.  Loss or delay would significantly impact him or her.  Errors of this sort might delay payment to the user, but would not normally result in permanent loss.  The potential individual financial impact to the agency is low, but the possible aggregate is moderate.

Examples4:
(4)  An agency employee has access to potentially sensitive personal client information.  She authenticates individually to the system at Level 2, but technical controls (such as a virtual private network) limit system access to the system to the agency premises.  Access to the premises is controlled, and the system logs her access instances.  In a less constrained environment, her access to personal sensitive information would create moderate potential impact for unauthorized release, but the system's security measures would reduce the overall risk to low.


LevelDescription:
Level 3 is appropriate for transactions needing high confidence in the asserted identity's accuracy.  People may use Level 3 credentials to access restricted web services without the need for additional identity assertion controls.

Examples1:
(1)  A patent attorney electronically submits confidential patent information to the U. S. Patent and Trademark Office.  Improper disclosure would give competitors a competitive advantage.

Examples2:
(2)  A supplier maintains an account with a General Services Administration Contracting Officer for a large government procurement.  The potential financial loss is significant, but not severe or catastrophic, so Level 4 is not appropriate.

Examples3:
(3)  A First Responder accesses a disaster management reporting website to report an incident, share operational information, and coordinate response activities.

Examples4:
(4)  An agency employee or contractor uses a remote system giving him access to potentially sensitive personal client information.  He works in a restricted-access Federal office building.  This limits physical access to his computer, but system transactions occur over the Internet.  The sensitive personal information available to him creates a moderate potential impact for unauthorized release.


LevelDescription:
Level 4 is appropriate for transactions needing very high confidence in the asserted identity's accuracy.  Users may present Level 4 credentials to assert identity and gain access to highly restricted web resources, without the need for further identity assertion controls.

Examples1:
(1)  A law enforcement official accesses a law enforcement database containing criminal records.  Unauthorized access could raise privacy issues and/or compromise investigations.

Examples2:
(2)  A Department of Veteran's Affairs pharmacist dispenses a controlled drug. She would need full assurance that a qualified doctor prescribed it.  She is criminally liable for any failure to validate the prescription and dispense the correct drug in the prescribed amount.

Examples3:
(3)  An agency investigator uses a remote system giving her access to potentially sensitive personal client information.  Using her laptop at client worksites, personal residences, and businesses, she access information over the Internet via various connections. The sensitive personal information she can access creates only a moderate potential impact for unauthorized release, but her laptop's vulnerability and her non-secure Internet access raise the overall risk.


# Consequence Questions

Threat Scenario:
If an unauthorized actor uses this “create” transaction, there is a possibility that new data will be inappropriately recorded about an authorized user, potentially resulting in an inability to use the user’s existing data for its intended purpose.  Answer the following questions to determine the effect(s) of interrupting the ability to use an authorized user’s existing data for the intended purpose:

ConQ1:
What inconveniences, distress, or damages would occur to the standing or reputation of any involved party?

ConQ2:
What potential financial losses would be incurred by any involved party?

ConQ3:
What harm to agency programs or public interest would be realized?

ConQ4:
What effect(s) would result from an unauthorized release of sensitive information (based on FIPS 199 definitions)?

ConQ6:
What civil or criminal violations would the agency be subjected to?


Threat Scenario:
If an unauthorized actor uses this “delete” transaction, there is a possibility that important data owned by an authorized user will be inappropriately eliminated, either temporarily or permanently.  Answer the following questions to determine the effect(s) of temporarily or permanently destroying an authorized user’s existing data:


Threat Scenario:
If an unauthorized actor uses this “inquire” transaction, there is a possibility that important data owned by an authorized user will be inappropriately disclosed.  Answer the following questions to determine the effect(s) of disclosing an authorized user’s existing data:


Threat Scenario:
If an unauthorized actor uses this “modify” transaction, there is a possibility that important data owned by an authorized user will be inappropriately changed.  Answer the following questions to determine the effect(s) of modifying a authorized user’s existing data:


# Initiative

Initiative Description:
Description words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words wordsDescription words words words.Description words words words


# OMB Table 1

ImpactCategory:
Inconvenience, distress, or damage to standing or reputation


ImpactCategory:
Harm to agency programs or public interests


ImpactCategory:
Unauthorized release of sensitive information


# Response

Response:
What inconveniences, distress, or damages would occur to the standing or reputation of any involved party?


Response:
What potential financial losses would be incurred by any involved party?


Response:
What harm to agency programs or public interest would be realized?


Response:
What effect(s) would result from an unauthorized release of sensitive information (based on FIPS 199 definitions)?


Response:
What civil or criminal violations would the agency be subjected to?


# Risk Tolerance Criteria

ImpactCritMed:
At worst, serious short term or limited long-term inconvenience, distress, or damage to the standing or reputation of any party.

ImpactCritLow:
At worst, limited, short-term inconvenience, distress, or embarrassment to any party.


# Risk Tolerance Criteria Reference

ImpactCritHigh:
Severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party.

ImpactCritMed:
At worst, serious short term or limited long-term inconvenience, distress, or damage to the standing or reputation of any party.

ImpactCritLow:
At worst, limited, short-term inconvenience, distress, or embarrassment to any party.


ImpactCritHigh:
Severe or catastrophic unrecoverable financial loss to any party; or severe or catastrophic agency liability.

ImpactCritMed:
At worst, a serious unrecoverable financial loss to any party, or a serious agency liability.

ImpactCritLow:
At worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, an insignificant or inconsequential agency liability.


ImpactArea:
Harm to agency programs or public interest

ImpactCritHigh:
A severe or catastrophic adverse effect on organizational operations or assets, or public interests.

ImpactCritMed:
At worst, a serious adverse effect on organizational operations or assets, or public interests.

ImpactCritLow:
At worst, a limited adverse effect on organizational operations or assets, or public interests.


ImpactArea:
Unauthorized release of sensitive information

ImpactCritHigh:
A release of personal, U. S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with high impact as defined in FIPS PUB 199.

ImpactCritMed:
At worst, a release of personal, U. S. government sensitive or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a moderate impact as defined in FIPS PUB 199.

ImpactCritLow:
At worst, a limited release of personal, U. S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS PUB 199.


ImpactCritMed:
At worst, a moderate risk of minor injury or limited risk of injury requiring medical treatment.

ImpactCritLow:
At worst, minor injury not requiring medical treatment.


ImpactCritHigh:
A risk or civil or criminal violations that are of special importance to enforcement programs.

ImpactCritMed:
At worst, a risk of civil or criminal violations that may be subject to enforcement efforts.

ImpactCritLow:
At worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts.


# Switchboard Items

ItemText:
View/Print Application Risk Tolerance Criteria Report


ItemText:
Activity 8 - Transaction Assurance Levels


ItemText:
View/Print Transaction Level Summary Report


ItemText:
View/Print User Role Level Summary Report


# Transaction

Transaction Description:
Transaction description for second transaction


