> ***GUIDELINES FOR THE RISK ANALYSIS CHECKLIST:***
>
> This checklist is provided as part of the evaluation process for the
> Risk Analysis. The checklist assists designated reviewers in
> determining whether specifications meet criteria established in HUD's
> System Development Methodology (SDM). The objective of the evaluation
> is to determine whether the document complies with HUD development
> methodology requirements.
>
> Attached to this document is the DOCUMENT REVIEW CHECKLIST. Its
> purpose is to assure that documents achieve the highest standards
> relative to format, consistency, completeness, quality, and
> presentation.
>
> Submissions must include the following three documents, and must be
> presented in the following order: (First) Document Review Checklist,
> (Second) the Risk Analysis Checklist, and (Third) the Risk Analysis.
>
> Document authors are required to complete the two columns indicated as
> "AUTHOR X-REFERENCE Page #/Section #" and "AUTHOR COMMENTS" before the
> submission. Do NOT complete the last two columns marked as "COMPLY"
> and "REVIEWER COMMENTS" since these are for the designated reviewers.
>
> Document reviewers will consult the HUD SDM and the SDM templates when
> reviewing the documents and completing the reviewer's portions of this
> checklist.

  -----------------------------------------------------------------------
  AUTHOR REFERENCE (Project Identifier):

  -----------------------------------------------------------------------

  ---------------------- ---------- -------------- -------------- ----------------------
  ***Designated          ***Start   ***Completed   ***Area        ***Comments:***
  Reviewers:***          Date:***   Date:***       Reviewed:***   

  *1:*                                                            

  *2:*                                                            

  *3:*                                                            

  *4:*                                                            

  *Summary Reviewer:*                                             
  ---------------------- ---------- -------------- -------------- ----------------------

  -----------------------------------------------------------------------
  **The determination of the type of risk assessment to be performed
  relates to the decision made during the determine category process
  described in section 1.3 of the System Development Methodology. The
  level of effort required to perform a risk analysis will be much
  greater for a new development effort than for an enhancement project.**

  -----------------------------------------------------------------------

**TABLE OF CONTENTS**

+-----------------------------------+-----------------------------------+
| #                                 | #                                 |
|                                   |                                   |
| # 1.0 General Information         | # 4.0 Risks and Safeguards        |
|                                   |                                   |
| ## 1.1 Purpose                    | ## \*4.x \[Risk Name\]            |
|                                   |                                   |
| ## 1.2 Scope                      | ### 4.x.1 Risk Category           |
|                                   |                                   |
| ## 1.3 System Overview            | ### 4.x.2 Risk Impact             |
|                                   |                                   |
| ## 1.4 Project References         | ### 4.x.3 Potential Safeguards    |
|                                   |                                   |
| ## 1.5 Acronyms and Abbreviations | #### 4.x.3.y \[Safeguard Name\]   |
|                                   |                                   |
| ## 1.6 Points of Contact          | # 5.0 Cos                         |
|                                   | t and Effectiveness of Safeguards |
| ### 1.6.1 Information             |                                   |
|                                   | ## \*5.x Potential Safeguards     |
| ### 1.6.2 Coordination            |                                   |
|                                   | ### 5.x.1 Lifecycl                |
| # 2                               | e Costs for Acceptable Safeguards |
| .0 Project and System Description |                                   |
|                                   | ### 5.x                           |
| ## 2.1 Summary                    | .2 Effects of Safeguards on Risks |
|                                   |                                   |
| ### 2                             | ### 5.x.3 E                       |
| .1.1 Project Management Structure | conomic Feasibility of Safeguards |
|                                   |                                   |
| ### 2.1.2 Project Staffing        | # 6                               |
|                                   | .0 Risk Reduction Recommendations |
| ## 2.2 Risk Management Structure  |                                   |
|                                   | \* Each risk or safeguard should  |
| ## 2.3 Periodic Risk Assessment   | be under a separate header.       |
|                                   | Generate new sections and         |
| ## 2.4 Contingency Planning       | subsections as necessary for each |
|                                   | risk from 4.1 through 4.x, and    |
| # 3.0 System Security             | for each safeguard from 5.1       |
|                                   | through 5.x.                      |
| ## 3                              |                                   |
| .1 Baseline Security Requirements |                                   |
|                                   |                                   |
| ##                                |                                   |
|  3.2 Baseline Security Safeguards |                                   |
|                                   |                                   |
| ## 3.3 Sensitivity Level of Data  |                                   |
|                                   |                                   |
| ## 3.4 User Security In           |                                   |
| vestigation Level and Access Need |                                   |
|                                   |                                   |
| ##                                |                                   |
+-----------------------------------+-----------------------------------+

<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 33%" />
<col style="width: 12%" />
<col style="width: 20%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 18%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"></th>
<th colspan="2"><strong>To be completed by Author</strong></th>
<th colspan="6"><strong>To be completed by Reviewer</strong></th>
</tr>
<tr class="odd">
<th colspan="2"><strong>REQUIREMENT</strong></th>
<th><strong>AUTHOR X‑REFERENCE Page #/Section #</strong></th>
<th><strong>AUTHOR COMMENTS</strong></th>
<th colspan="4"><strong>COMPLY</strong></th>
<th colspan="2"><strong>REVIEWER COMMENTS</strong></th>
</tr>
<tr class="header">
<th colspan="2"></th>
<th></th>
<th></th>
<th colspan="2"><strong>Y</strong></th>
<th colspan="2"><strong>N</strong></th>
<th colspan="2"></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="2">1.0 GENERAL INFORMATION</td>
<td></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-3">1.1</h5></td>
<td><strong>Purpose:</strong> Describe the purpose of the Risk
Analysis.</td>
<td><h5 id="section-4"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-5">1.2</h5></td>
<td><strong>Scope:</strong> Describe the scope of the Risk Analysis as
it relates to the project.</td>
<td><h5 id="section-6"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-7">1.3</h5></td>
<td><strong>System Overview:</strong> Provide a brief system overview
description as a point of reference for the remainder of the document,
including responsible organization, system name or title, system code,
system category, operational status, and system environment or special
conditions.</td>
<td><h5 id="section-8"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-9">1.4</h5></td>
<td><strong>Project References:</strong> Provide a list of the
references that were used in preparation of this document.</td>
<td><h5 id="section-10"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-11">1.5</h5></td>
<td><strong>Acronyms and Abbreviations:</strong> Provide a list of the
acronyms and abbreviations used in this document and the meaning of
each.</td>
<td><h5 id="section-12"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-13">1.6</h5></td>
<td colspan="9"><strong>Points of Contact:</strong></td>
</tr>
<tr class="even">
<td><h5 id="section-14"></h5></td>
<td>1.6.1 <strong>Information:</strong> Provide a list of the points of
organizational contact that may be needed by the document user for
informational and troubleshooting purposes.</td>
<td><h5 id="section-15"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-16"></h5></td>
<td>1.6.2 <strong>Coordination:</strong> Provide a list of organizations
that require coordination between the project and its specific support
function (e.g., installation coordination, security, etc.). Include a
schedule for coordination activities.</td>
<td><h5 id="section-17"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>

<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 33%" />
<col style="width: 12%" />
<col style="width: 20%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 18%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"></th>
<th colspan="2"><strong>To be completed by Author</strong></th>
<th colspan="6"><strong>To be completed by Reviewer</strong></th>
</tr>
<tr class="odd">
<th colspan="2"><strong>REQUIREMENT</strong></th>
<th><strong>AUTHOR X‑REFERENCE Page #/Section #</strong></th>
<th><strong>AUTHOR COMMENTS</strong></th>
<th colspan="4"><strong>COMPLY</strong></th>
<th colspan="2"><strong>REVIEWER COMMENTS</strong></th>
</tr>
<tr class="header">
<th colspan="2"></th>
<th></th>
<th></th>
<th colspan="2"><strong>Y</strong></th>
<th colspan="2"><strong>N</strong></th>
<th colspan="2"></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="5">2.0 PROJECT AND SYSTEM DESCRIPTION</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-18">2.1</h5></td>
<td><strong>Summary:</strong> Provide basic information about the
project and the application system for which a risk analysis is being
conducted.</td>
<td><h5 id="section-19"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-20"></h5></td>
<td>2.1.1 <strong>Project Management Structure:</strong> Identify the
project sponsor, sponsoring office project leader, and the estimated or
actual start and end dates of a new or modified system project.</td>
<td><h5 id="section-21"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-22"></h5></td>
<td>2.1.2 <strong>Project Staffing:</strong> Determine the approximate
number of staff hours required (HUD personnel and contractors) and
identify the expertise, knowledge, skills, and abilities needed by the
project team to develop and/or maintain a quality application
system.</td>
<td><h5 id="section-23"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-24">2.2</h5></td>
<td><strong>Risk Management Structure:</strong> Identify organizations
responsible for managing identified risks and maintaining
countermeasures.</td>
<td><h5 id="section-25"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-26">2.3</h5></td>
<td><strong>Periodic Risk Assessment:</strong> Describe the frequency of
periodic risk assessments of the operational system.</td>
<td><h5 id="section-27"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-28">2.4</h5></td>
<td><strong>Contingency Planning:</strong> Determine the level of
contingency planning needed and identify the responsible personnel
involved.</td>
<td><h5 id="section-29"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>

<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 33%" />
<col style="width: 12%" />
<col style="width: 20%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 18%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"></th>
<th colspan="2"><strong>To be completed by Author</strong></th>
<th colspan="6"><strong>To be completed by Reviewer</strong></th>
</tr>
<tr class="odd">
<th colspan="2"><strong>REQUIREMENT</strong></th>
<th><strong>AUTHOR X‑REFERENCE Page #/Section #</strong></th>
<th><strong>AUTHOR COMMENTS</strong></th>
<th colspan="4"><strong>COMPLY</strong></th>
<th colspan="2"><strong>REVIEWER COMMENTS</strong></th>
</tr>
<tr class="header">
<th colspan="2"></th>
<th></th>
<th></th>
<th colspan="2"><strong>Y</strong></th>
<th colspan="2"><strong>N</strong></th>
<th colspan="2"></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="5">3.0 SYSTEM SECURITY</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-30"></h5></td>
<td>Assess the security requirements and specifications necessary to
safeguard the system and its corresponding data.</td>
<td><h5 id="section-31"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-32">3.1</h5></td>
<td><strong>Baseline Security Requirements:</strong> Analyze the
processes and procedures required of the new system or the system to be
replaced and the sensitivity of the data the system will be processing
to determine inherent security risks.</td>
<td><h5 id="section-33"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-34">3.2</h5></td>
<td><strong>Baseline Security Safeguards:</strong> Describe the
security-related technology that is currently available or projected to
be available at the time the system is scheduled for operation.</td>
<td><h5 id="section-35"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-36">3.3</h5></td>
<td><strong>Sensitivity Level of Data:</strong> Evaluate the data being
processed to determine whether the level of sensitivity requires
safeguards, such as the application of security controls.</td>
<td><h5 id="section-37"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-38">3.4</h5></td>
<td><strong>User Security Investigation Level and Access Need:</strong>
Analyze the system’s end users, including those having direct access to
the system and those who will indirectly receive output from the
system.</td>
<td><h5 id="section-39"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>

<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 33%" />
<col style="width: 12%" />
<col style="width: 20%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 18%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"></th>
<th colspan="2"><strong>To be completed by Author</strong></th>
<th colspan="6"><strong>To be completed by Reviewer</strong></th>
</tr>
<tr class="odd">
<th colspan="2"><strong>REQUIREMENT</strong></th>
<th><strong>AUTHOR X‑REFERENCE Page #/Section #</strong></th>
<th><strong>AUTHOR COMMENTS</strong></th>
<th colspan="4"><strong>COMPLY</strong></th>
<th colspan="2"><strong>REVIEWER COMMENTS</strong></th>
</tr>
<tr class="header">
<th colspan="2"></th>
<th></th>
<th></th>
<th colspan="2"><strong>Y</strong></th>
<th colspan="2"><strong>N</strong></th>
<th colspan="2"></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="5">4.0 RISKS AND SAFEGUARDS</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-40"></h5></td>
<td>Evaluate the proposed system and its operational environment for
potential risks (physical, communication, hardware, and software) and
safeguards. Identify the potential security risks and provide the
following information for each.</td>
<td><h5 id="section-41"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="x">4.x</h5></td>
<td><strong>[Risk Name]:</strong> <em>(Each risk in the following
subsections should be under a separate header. Generate new subsections
as necessary for each risk from 4.1 through 4.x.)</em> Provide a risk
name and identifier here for reference in the remainder of the
subsection.</td>
<td><h5 id="section-42"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-43"></h5></td>
<td>4.x.1 <strong>Risk Category:</strong> Identify the category of risk
(physical, communications, hardware, software).</td>
<td><h5 id="section-44"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-45"></h5></td>
<td>4.x.2 <strong>Risk Impact:</strong> Provide an assessment of the
magnitude of the risk's impact in the event of an occurrence.</td>
<td><h5 id="section-46"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-47"></h5></td>
<td>4.x.3 <strong>Potential Safeguard(s)</strong></td>
<td><h5 id="section-48"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-49"></h5></td>
<td><ol start="25" type="a">
<li><p><strong>[Safeguard Name]:</strong> <em>(Each safeguard in this
subsection should be under a separate header. Generate new subsections
as necessary for each safeguard from 4.1.3.1 through
4.x.3.y.)</em>Provide a name and identifier here for the potential
safeguard for reference in the corresponding subsection of 5.x and
describe the safeguard.</p></li>
</ol></td>
<td><h5 id="section-50"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>

<table>
<colgroup>
<col style="width: 3%" />
<col style="width: 33%" />
<col style="width: 12%" />
<col style="width: 20%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 5%" />
<col style="width: 0%" />
<col style="width: 18%" />
</colgroup>
<thead>
<tr class="header">
<th colspan="2"></th>
<th colspan="2"><strong>To be completed by Author</strong></th>
<th colspan="6"><strong>To be completed by Reviewer</strong></th>
</tr>
<tr class="odd">
<th colspan="2"><strong>REQUIREMENT</strong></th>
<th><strong>AUTHOR X‑REFERENCE Page #/Section #</strong></th>
<th><strong>AUTHOR COMMENTS</strong></th>
<th colspan="4"><strong>COMPLY</strong></th>
<th colspan="2"><strong>REVIEWER COMMENTS</strong></th>
</tr>
<tr class="header">
<th colspan="2"></th>
<th></th>
<th></th>
<th colspan="2"><strong>Y</strong></th>
<th colspan="2"><strong>N</strong></th>
<th colspan="2"></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td colspan="5">5.0 COST AND EFFECTIVENESS OF SAFEGUARDS</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="x-1">5.x</h5></td>
<td><strong>Potential Safeguards:</strong> <em>(Each safeguard in this
section should be under a separate header. Generate new sections as
necessary for each safeguard from 5.1 through 5.x.)</em>Review each of
the safeguards identified in the corresponding subsection of 4.x.3.y and
determine whether it is appropriate for use within the system’s
operational environment.</td>
<td><h5 id="section-51"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-52"></h5></td>
<td>5.x.1 <strong>Lifecycle Costs for Acceptable Safeguards:</strong>
Estimate the cost to develop, install, and operate each of the proposed
system safeguards.</td>
<td><h5 id="section-53"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td><h5 id="section-54"></h5></td>
<td>5.x.2 <strong>Effect of Safeguards on Risks:</strong> Estimate the
extent to which the recommended safeguard will be effective in
preventing or minimizing that threat or vulnerability for each of the
proposed system’s identified risks and vulnerabilities.</td>
<td><h5 id="section-55"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-56"></h5></td>
<td>5.x.3 <strong>Economic Feasibility of Safeguards:</strong> Contrast
the lifecycle costs of each of the potential safeguards against the
financial impact of the security risks they are designed to
prevent.</td>
<td><h5 id="section-57"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="even">
<td colspan="5">6.0 RISK REDUCTION RECOMMENDATIONS</td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
<tr class="odd">
<td><h5 id="section-58"></h5></td>
<td>Outline the potential security risks to the system to be developed
or replaced and provide a detailed description of the security
safeguards that are being recommended to counteract those risks.</td>
<td><h5 id="section-59"></h5></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td colspan="2"></td>
<td></td>
</tr>
</tbody>
</table>