The Three Reference Systems
Every example in this course uses one of three fictional systems. None describes a real agency system. They were chosen so that each major decision in the Risk Management Framework appears at least once.
| System | Impact (C / I / A) | Baseline | Role in the course |
|---|---|---|---|
| CivicCRM | Low / Low / Low | Low; privacy baseline not selected | Module 0 examples; the discipline of documented exclusion |
| TreasuryFlow | Moderate / Moderate / Moderate | Moderate plus privacy | The learner's own system from Module 2 onward |
| SentinelBAS | Moderate / High / High | High plus privacy | Operational technology; where standard instincts are wrong |
CivicCRM
A cloud-native application a small federal office uses for event scheduling and non-sensitive public inquiries.
- Information: public affairs and outreach content; event scheduling records containing organizational points of contact only (partner organization, role title, organizational email); general public inquiries through free-text fields that are filtered and not designed to elicit personal detail.
- Personal information: none collected, processed, or stored. A signed Privacy Threshold Analysis records that determination.
- Technology: serverless front end, managed relational database, single cloud region.
- Course additions (Module 0): a managed load balancer, a managed file store for event flyers, a nightly reporting function, a hosted deployment pipeline, staff sign-in through the agency identity provider, and about 20 staff users in coordinator, supervisor, and administrator roles.
- Watch point: a free-text field on a public form is the most common way a "no personal information" system becomes one that holds it.
TreasuryFlow
A cloud-native financial transactions service deployed on infrastructure-as-a-service authorized at the FedRAMP High level.
- Information: financial management information (payments and receivables); taxpayer and recipient identification data, including Social Security and taxpayer identification numbers; bank routing and account numbers; mailing addresses; full transaction history.
- Personal information: yes; records are retrieved by taxpayer identification number.
- Technology: multi-region; containerized microservices; event-driven payment pipeline.
- Categorization note: integrity is rated Moderate with upward pressure. It stays Moderate because payment release needs an out-of-band approval, daily reconciliation detects alteration within one business day, and disbursements are recoverable. Without those business processes it would be High. That reasoning must be documented.
- Notable roles: payment preparer and payment approver, which one person may not hold together.
SentinelBAS
A cloud-connected building automation and operational technology platform at a high-containment biological facility.
- Functions: heating, ventilation, and directional airflow control; negative-pressure monitoring; badge and biometric access integration; visitor logging; life-safety interlocks.
- Personal information: yes, through biometric templates and visitor records.
- Why it is different: on a life-safety system, availability and integrity outrank confidentiality, and a security measure that could interrupt a safety interlock is a hazard. Active vulnerability scanning of field controllers, for example, is prohibited without a maintenance window and a safety review.