Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > 2.3.2 Risk Executive (Function)

2.3.2 Risk Executive (Function)

The risk executive is a functional role established within organizations to provide a more
comprehensive, organization-wide approach to risk management. The risk executive (function)
serves as the common risk management resource for senior leaders/executives, mission/business
owners, chief information officers, chief information security officers, information system
owners, common control providers,25 enterprise architects, information security architects,
information systems/security engineers, information system security managers/officers, and any
other stakeholders having a vested interest in the mission/business success of organizations. The
risk executive (function) coordinates with senior leaders/executives to:
• Establish risk management roles and responsibilities;
23 Information security governance outcomes adapted from IT Governance Institute, Information Security Governance:
Guidance for Boards of Directors and Executive Management, 2nd Edition, 2006.
24 There is no implication by listing various titles within an organization of any particular relationship (peer or
otherwise) or lines of authority.
25 A common control provider is an organizational official responsible for the development, implementation,
assessment, and monitoring of common controls (i.e., security controls inherited by information systems).
• Develop and implement an organization-wide risk management strategy that guides and
informs organizational risk decisions (including how risk is framed, assessed, responded to,
and monitored over time); 26
• Manage threat and vulnerability information with regard to organizational information
systems and the environments in which the systems operate;
• Establish organization-wide forums to consider all types and sources of risk (including
aggregated risk);
• Determine organizational risk based on the aggregated risk from the operation and use of
information systems and the respective environments of operation;
• Provide oversight for the risk management activities carried out by organizations to ensure
consistent and effective risk-based decisions;
• Develop a greater understanding of risk with regard to the strategic view of organizations and
their integrated operations;
• Establish effective vehicles and serve as a focal point for communicating and sharing risk-
related information among key stakeholders internally and externally to organizations;
• Specify the degree of autonomy for subordinate organizations permitted by parent
organizations with regard to framing, assessing, responding to, and monitoring risk;27
• Promote cooperation and collaboration among authorizing officials to include security
authorization actions requiring shared responsibility (e.g., joint/leveraged authorizations);28
• Ensure that security authorization decisions consider all factors necessary for mission and
business success; and
• Ensure shared responsibility for supporting organizational missions and business functions
using external providers receives the needed visibility and is elevated to appropriate decision-
making authorities.
The risk executive (function) presumes neither a specific organizational structure nor formal
responsibility assigned to any one individual or group within the organization. Heads of agencies
or organizations may choose to retain the risk executive (function) or to delegate the function.
The risk executive (function) requires a mix of skills, expertise, and perspectives to understand
the strategic goals and objectives of organizations, organizational missions/business functions,
technical possibilities and constraints, and key mandates and guidance that shape organizational
operations. To provide this needed mixture, the risk executive (function) can be filled by a single
individual or office (supported by an expert staff) or by a designated group (e.g., a risk board,
26 Organizational risk decisions include investment decisions (see Section 2.3.4). Organizational risk tolerance is
determined as part of the risk framing component (see Section 2.3.3) and defined in the risk management strategy.
27 Because subordinate organizations responsible for carrying out derivative or related missions may have already
invested in their own methods of framing, assessing, responding to, and monitoring risk, parent organizations may
allow a greater degree of autonomy within parts of the organization or across the entire organization in order to
minimize costs. When a diversity of risk management activities is allowed, organizations may choose to employ, when
feasible, some means of translation and/or synthesis of the risk-related information produced from those activities to
ensure that the output of the different activities can be correlated in a meaningful manner.
28 NIST Special Publication 800-37 provides guidance on joint and leveraged authorizations.
executive steering committee, executive leadership council).29 The risk executive (function) fits
into the organizational governance structure in such a way as to facilitate efficiency and to
maximize effectiveness. While the organization-wide scope situates the risk executive (function)
at Tier 1, its role entails ongoing communications with and oversight of the risk management
activities of mission/business owners, authorizing officials, information system owners, common
control providers, chief information officers, chief information security officers, information
system and security engineers, information system security managers/officers, and other
stakeholders at Tiers 2 and 3.
To be effective, organization‐wide risk management programs require the strong commitment,
direct involvement, and ongoing support from senior leaders/executives. The objective is to
institutionalize risk management into the day‐to‐day operations of organizations as a priority and
an integral part of how organizations conduct operations in cyberspace-recognizing that this is
essential in order to successfully carry out missions in threat‐laden operational environments.