DoD 8500.2 establishes IA controls for information systems according to the Mission Assurance Categories (MAC) and confidentiality levels. Which of the following MAC levels requires high integrity and

Question

Options

• AMAC I
• BMAC II
• CMAC III
• DMAC IV

• A
  2% (1)
• B
  88% (43)
• C
  2% (1)
• D
  8% (4)

Explanation

MAC II is correct because DoD 8500.2 explicitly assigns it high integrity (data must be accurate and trustworthy) combined with medium availability (systems must be accessible but can tolerate some downtime). MAC II systems typically support warfighting indirectly - such as logistics or communications systems that are mission-relevant but not immediately life-critical.

Why the distractors are wrong:

• A (MAC I): Requires both high integrity and high availability - the most stringent level, reserved for systems that directly support combat operations where any outage could cost lives.
• C (MAC III): The least critical level, requiring only basic integrity and basic availability - used for administrative or business-support systems not directly tied to the mission.
• D (MAC IV): Does not exist in DoD 8500.2 - the standard only defines three MAC levels (I, II, III).

Memory tip: Think of MAC levels as descending urgency - MAC I = everything high, MAC II = integrity stays high but availability drops to medium, MAC III = everything drops to basic. The integrity requirement steps down as the mission criticality decreases, while MAC II is the "middle child" that keeps integrity strict but relaxes availability.

No community discussion yet for this question.