Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > TASK 3-4: Implement the course of action selected to respond to risk.

TASK 3-4: Implement the course of action selected to respond to risk.

Supplemental Guidance: Once a course of action is selected, organizations implement the associated risk response.
Given the size and complexity of some organizations, the actual implementation of risk response measures may be
challenging. Some risk response measures are tactical in nature (e.g., applying patches to identified vulnerabilities in
organizational information systems) and may be implemented rather quickly. Other risk response measures may be
more strategic in nature and reflect solutions that take much longer to implement. Therefore, organizations apply, and
tailor as appropriate to a specific risk response course of action, the risk response implementation considerations in the
risk response strategies (part of the risk management strategy developed during the risk framing step). See Appendix H,
Risk Response Strategies.
Outputs and Post Conditions
The output of the risk response step is the implementation of the selected courses of action with consideration for: (i)
individuals or organizational elements responsible for the selected risk response measures and specifications of
effectiveness criteria (i.e., articulation of indicators and thresholds against which the effectiveness of risk response
measures can be judged); (ii) dependencies of each selected risk response measure on other risk response measures;
(iii) dependencies of selected risk response measures on other factors (e.g., the implementation of other planned
information technology measures); (iv) timeline for implementation of risk response measures; (v) plans for monitoring
the effectiveness of risk response measures; (vi) identification of risk monitoring triggers; and (vii) interim risk
response measures selected for implementation, if appropriate. There are also ongoing communications and sharing of
risk-related information with individuals or organizational elements impacted by the risk responses (including potential
actions that may need to be taken by the individuals or organizational elements).
In addition to the risk monitoring step, outputs from the risk response step can be useful inputs to the risk framing and
risk assessment steps. For example, it is possible that the analysis occurring during the evaluation of alternative courses
of action may call into question some aspects of the risk response strategy that is part of the risk management strategy
generated during the risk framing step. In such instances, organizations use that information to inform the risk framing
step with appropriate actions taken to revisit the risk management strategy and its associated risk response strategy.
Organizations might also determine during the evaluation of alternative courses of action for risk response, that some
aspects of the risk assessments are incomplete or incorrect. This information can be used to inform the risk assessment
step possibly resulting in further analysis or reassessments of risk.