Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO

INFORMATION SYSTEM

COMMUNICATION
AND REPORTING
RISK MANAGEMENT
ACROSS LEVELS
More detailed and granular risk perspective.
Broad-based risk perspective.

The activities conducted at Levels 1 and 2 are critical to preparing the organization to execute
the RMF. Such preparation involves a wide range of activities that go beyond simply managing
the security and privacy risk associated with operating or using specific systems and includes
activities that are essential to managing security and privacy risk appropriately throughout the
organization. Decisions about how to manage such risk at the system level cannot be made in
isolation. Such decisions are closely linked to the:
•
Mission or business objectives of organizations;
•
Modernization initiatives for systems, components, and services;
•
Enterprise architecture and the need to manage and reduce the complexity20 of systems
through consolidation, optimization, and standardization;21 and
•
Allocation of resources to ensure the organization can conduct its missions and business
operations effectively, efficiently, and in a cost-effective manner.
Preparing the organization to execute the RMF can include:
•
Assigning roles and responsibilities for organizational risk management processes;
•
Establishing a risk management strategy and organizational risk tolerance;
•
Identifying the missions, business functions, and mission/business processes the
information system is intended to support;
•
Identifying key stakeholders (internal and external to the organization) that have an interest
in the information system;
•
Identifying and prioritizing assets (including information assets);
•
Understanding threats to information systems and organizations;
•
Understanding the potential adverse effects on individuals;
•
Conducting organization- and system-level risk assessments;
•
Identifying and prioritizing security and privacy requirements;22
•
Determining authorization boundaries for information systems and common controls;23
•
Defining information systems in terms of the enterprise architecture;
•
Developing the security and privacy architectures that include controls suitable for
inheritance by information systems;
20 Managing complexity of systems through consolidation, optimization, and standardization reduces the attack
surface and technology footprint exploitable by adversaries.
21 Enterprise architecture defines the mission, information, and the technologies necessary to perform the mission,
and transitional processes for implementing new technologies in response to changing mission needs. It also includes
a baseline architecture, a target architecture, and a sequencing plan. [OMB FEA] provides guidance for implementing
enterprise architectures.
22 Security and privacy requirements can be obtained from many sources (e.g., laws, executive orders, directives,
regulations, policies, standards, and mission/business/operational requirements).
23 Authorization boundaries determine the scope of authorizations for information systems and common controls
(i.e., the system elements that define the system or the set of common controls available for inheritance).