which category level would be indicated for a violation that "has the potential to result in a system's loss of confidentiality, integrity, or availability"