![](media/image1.png){width="2.625in" height="0.96875in"}**Department of
Health & Human Services**

Centers for Medicare & Medicaid Services

7500 Security Boulevard,

Baltimore, Maryland 21244-1850

**CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS)**

***click here and enter system owner\'s office/center***

***click here and enter system owner\'s group***

7500 Security Blvd

Baltimore, MD 21244-1850

***click here and enter system name & acronym***

***Information Security Risk Assessment (RA)***

***RA Version \# click here and enter version \#***

***RA Date click here and enter date of SSP***

**RA Template v1.1 -- September 12, 2002**

# System documentation

## System Identification

### System Name/Title

####  {#section .unnumbered}

  -------------------------------- --------------------------------------
  Official System Name             

  System Acronym                   

  System of Records (SOR)          

  Financial Management Investment  
  Board (FMIB) Number              

  Web Support Team (WST) Number    

  System Type (select one)         GSS, MA or "Other" System
  -------------------------------- --------------------------------------

### Responsible Organization

  -------------------------------- --------------------------------------
  Name of Organization             

  Address                          

  City, State, Zip                 

  Contract Number, Contractor      
  contact information (if          
  applicable)                      
  -------------------------------- --------------------------------------

### Information Contact(s)

  -------------------------------- --------------------------------------
  Name (System Owner/Manager)      

  Title                            

  Name of Organization             

  Address                          

  Mailstop                         

  City, State, Zip                 

  Email Address                    

  Phone number                     

  Contractor contact information   
  (if applicable)                  
  -------------------------------- --------------------------------------

  -------------------------------- --------------------------------------
  Name (Business Owner/Manager)    

  Title                            

  Name of Organization             

  Address                          

  Mailstop                         

  City, State, Zip                 

  Email Address                    

  Phone number                     

  Contractor contact information   
  (if applicable)                  
  -------------------------------- --------------------------------------

  -------------------------------- --------------------------------------
  Name (System Maintainer Manager) 

  Title                            

  Name of Organization             

  Address                          

  Mailstop                         

  City, State, Zip                 

  Email Address                    

  Phone number                     

  Contractor contact information   
  (if applicable)                  
  -------------------------------- --------------------------------------

  -------------------------------- --------------------------------------
  Name (IS RA Author)              

  Title                            

  Name of Organization             

  Address                          

  Mailstop                         

  City, State, Zip                 

  Email Address                    

  Phone number                     

  Contractor contact information   
  (if applicable)                  
  -------------------------------- --------------------------------------

### Assignment of Security Responsibility

  ------------------------------ ----------------------------------------
  Name (individual\[s\]          
  responsible for security)      

  Title                          

  Name of Organization           

  Address                        

  Mailstop                       

  City, State, Zip               

  Email Address                  

  Phone number                   

  Emergency Contact Information  
  (name, phone and e-mail only)  
  ------------------------------ ----------------------------------------

  ------------------------------ ----------------------------------------
  Name (Component ISSO)          

  Title                          

  Name of Organization           

  Address                        

  Mailstop                       

  City, State, Zip               

  Email Address                  

  Phone number                   

  Emergency Contact Information  
  (name, phone and e-mail only)  
  ------------------------------ ----------------------------------------

## Asset Identification 

  -----------------------------------------------------------------------
  Identify the assets covered by the RA, provide a brief description of
  the function and purpose of the system and the organizational business
  processes supported, including functions and processing of data. If it
  is part of a GSS, include all supported applications, as well as
  functions and information processed.

  -----------------------------------------------------------------------

> \[Click here and Type\]

### System Environment and Special Considerations

  -----------------------------------------------------------------------
  Provide a brief general technical description of the system. Discuss
  any environmental factors that raise special security concerns and
  document the physical location of the system. Provide a network diagram
  or schematic to help identify, define, and clarify the system
  boundaries for the system, and a general description of the system.

  -----------------------------------------------------------------------

> \[Click here and Type\]

### System Interconnection/Information Sharing

+-----------------------------------------------------------------------+
| For GSSs, show how the various components and sub-networks are        |
| connected and/or interconnected to any other Local Area Network (LAN) |
| or Wide Area Network (WAN).                                           |
|                                                                       |
| For MAs and "Other" Systems provide a description of the system and   |
| sub-applications or other software interdependencies.                 |
+-----------------------------------------------------------------------+

> \[Click here and Type\]

## System Security Level

  -----------------------------------------------------------------------
  Describe and document the information handled by the system and the
  overall system security level as LOW, MODERATE or HIGH. Refer to the
  CMS Information Security Levels document on
  http://CMSnet.cms.hhs.gov/CyberTyger.

  -----------------------------------------------------------------------

> \[Click here and Type\]

  ------------ --------------------- ------------------------------------
               **Information         **Level**
               Category**            

  **Security   \[Click here and      \[Click here and Type High, Moderate
  Level**      Type\]                or Low\]
  ------------ --------------------- ------------------------------------

# Risk Determination

  -----------------------------------------------------------------------
  The goal of this phase is to calculate the level of risk for each
  threat/vulnerability pair based on: (1) the likelihood of a threat
  exploiting a vulnerability; and (2) the severity of impact that the
  exploited vulnerability would have on the system, its data and its
  business function in terms of loss of confidentiality, loss of
  integrity and loss of availability. **Risk Level = Likelihood of
  Occurrence X Severity of Impact**

  -----------------------------------------------------------------------

**Risk Determination Table**

  -------- ---------- ----------------- --------------- ------------ -------------- ------------ ---------
  **Item   **Threat   **Vulnerability   **Risk          **Existing   **Likelihood   **Impact     **Risk
  No.**    Name**     Name**            Description**   Controls**   of             Severity**   Level**
                                                                     Occurrence**                

                                                                                                 

                                                                                                 
  -------- ---------- ----------------- --------------- ------------ -------------- ------------ ---------

# Safeguards Determination

  -----------------------------------------------------------------------
  The Safeguard Determination Phase involves identification of additional
  safeguards to minimize the threat exposure and vulnerability
  exploitation for each threat/vulnerability pairs identified in the Risk
  Determination Phase and resulting in moderate and high risk levels.

  -----------------------------------------------------------------------

> **Safeguard Determination Table**

  -------- ----------------------- -------------- ------------- ---------------
  **Item   **Recommended Safeguard **Residual     **Residual    **Residual Risk
  No**     Description**           Likelihood of  Impact        Level**
                                   Occurrence**   Severity**    

                                                                

                                                                
  -------- ----------------------- -------------- ------------- ---------------