Levels which are used in the DIACAP?

Answer 1

DoD systems are categorized in two ways: mission assurance category (MAC) and classification level (CL).

There are 3 MAC levels: I, II, and III.

Refer to DoDI 8500.2 for more details, but in general terms:

MAC I systems cannot ever go down - the mission of the organization fails, the war is lost, people die - bad, bad stuff happens if the system goes down without another system coming on line immediately to take over for it

MAC II systems cannot be down for very long. When they are down, mission capability is degraded until the capability is restored. A great many DoD systems fall in this category

MAC III systems need to be back up and running as soon as reasonable. They are not critical or vital to operations but do impact day to day operations. Public facing web sites, continuing learning sites, stuff like that are typical MAC III systems

There are 3 CL levels: classified, sensitive, public

Classified includes system handling information with Confidential, Secret, and Top Secret classifications

Sensitive includes systems handling unclassified information that is nevertheless sensitive such as Personal information (PII) like soldiers social security numbers, annual personnel evaluations, etc, as well as information that is FOUO or CUI (controlled unclassified information.

Public includes systems handling information open to the public such as public DoD web sites.