Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.2 ASSESSING RISK

3.2 ASSESSING RISK

Risk assessment identifies, prioritizes, and estimates risk to organizational operations (i.e.,
mission, functions, image, and reputation), organizational assets, individuals, other organizations,
and the Nation, resulting from the operation and use of information systems.62 Risk assessments
use the results of threat and vulnerability assessments to identify and evaluate risk in terms of
likelihood of occurrence and potential adverse impact (i.e., magnitude of harm) to organizations,
assets, and individuals. Risk assessments can be conducted at any of the risk management tiers
62 Draft NIST Special Publication 800-30, Revision 1, provides guidance on conducting risk assessments (including
incremental or differential risk assessments) across all three tiers in the multitiered risk management approach.
with different objectives and utility of the information produced. For example, risk assessments
conducted at Tier 1 or Tier 2 focus on organizational operations, assets, and individuals-whether
comprehensive across mission/business lines or only on those assessments that are cross-cutting
to the particular mission/business line. Organization-wide assessments of risk can be based solely
on the assumptions, constraints, risk tolerances, priorities, and trade-offs established in the risk
framing step (derived primarily from Tier 1 activities) or can be based on risk assessments
conducted across multiple mission/business lines (derived primarily from Tier 2 activities). Risk
assessments conducted at one tier can be used to refine/enhance threat, vulnerability, likelihood,
and impact information used in assessments conducted in other tiers. The degree that information
from risk assessments can be reused is shaped by the similarity of missions/business functions
and the degree of autonomy that organizational entities or subcomponents have with respect to
parent organizations. Organizations that are decentralized can expect to conduct more risk
assessment activities at Tier 2 and, as a result, may have a greater need to communicate within
Tier 2 to identify cross-cutting threats and vulnerabilities. Decentralized organizations can still
benefit from Tier 1 risk assessments and, in particular, the identification of an initial set of threat
and vulnerability sources. Organization-wide risk assessments provide some initial prioritization
of risks for decision makers to consider when entering the risk response step.
Organizations benefit significantly from conducting risk assessments as part of an organization-
wide risk management process. However, once risk assessments are complete, it is prudent for
organizations to invest some time in keeping the assessments current. Maintaining currency of
risk assessments requires support from the risk monitoring step (e.g., observing changes in
organizational information systems and environments of operation or analyzing monitoring
results to maintain awareness of the risk). Keeping risk assessments up to date provides many
potential benefits such as timely, relevant information that enables senior leaders/executives to
perform near real-time risk management. Maintaining risk assessments also reduces future
assessment costs and supports ongoing risk monitoring efforts. Organizations may determine that
conducting comprehensive risk assessments as a way of maintaining current risk assessments do
not provide sufficient value. In such situations, organizations consider conducting incremental
and/or differential risk assessments. Incremental risk assessments consider only new information
(e.g., the effects of using a new information system on mission/business risk), whereas
differential risk assessments consider how changes affect the overall risk determination.
Incremental or differential risk assessments are useful if organizations require a more targeted
review of risk, seek an expanded understanding of risk, or desire an expanded understanding of
the risk in relation to missions/business functions.