DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of…

DoD Instruction 8500.2 defines three Mission Assurance Categories (MAC) to classify systems based on their importance to the DoD mission. MAC III is designated for systems handling information necessary for day-to-day administrative or business operations but not for direct support of deployed or contingency forces. Consequently, these systems require only a basic level of assurance for integrity and availability, as their temporary failure can be tolerated without causing mission degradation.

A. MAC I requires the most stringent protection measures, representing the highest levels of integrity and availability for mission-critical systems where failure is unacceptable.

B. MAC II requires high levels of integrity and availability for systems that are important to mission support, where failure would cause serious degradation.

C. MAC IV is not a valid category; the DoD 8500.2 framework only defines MAC I, MAC II, and MAC III.

1. U.S. Department of Defense. (2003

February 6). DoD Instruction 8500.2

Information Assurance (IA) Implementation. Section 4.3.3

"MAC III

" states

"These systems require a basic level of IA controls."

2. National Institute of Standards and Technology (NIST). (2008

August). Special Publication 800-60 Volume II Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories. Appendix G

Section G.4

"DoD Mission Assurance Category and Confidentiality Level

" explicitly states

"MAC III systems require a basic level of integrity and availability."

3. Crane

M. E. (2005

March). A Risk Management Approach to Implementing Information Assurance [Thesis

Naval Postgraduate School]. Defense Technical Information Center (Accession Number: ADA433421). Page 12 states

"MAC III systems require a basic level of IA controls."