ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
CHAPTER THREE > THE PROCESS

THE PROCESS

CONDUCTING RISK ASSESSMENTS WITHIN ORGANIZATIONS
his chapter describes the process of assessing information security risk including: (i) a
high-level overview of the risk assessment process; (ii) the activities necessary to prepare
for risk assessments; (iii) the activities necessary to conduct effective risk assessments;
(iv) the activities necessary to communicate the assessment results and share risk-related
information; and (v) the activities necessary to maintain the results of risk assessments on an
ongoing basis. The risk assessment process43 is composed of four steps: (i) prepare for the
assessment; (ii) conduct the assessment; (iii) communicate assessment results; and (iv) maintain
the assessment.44 Each step is divided into a set of tasks. For each task, supplemental guidance
provides additional information for organizations conducting risk assessments. Risk tables and
exemplary assessment scales are listed in appropriate tasks and cross-referenced to additional,
more detailed information in the supporting appendices. Figure 5 illustrates the basic steps in the
risk assessment process and highlights the specific tasks for conducting the assessment.
FIGURE 5: RISK ASSESSMENT PROCESS
43 The intent of the process description in Chapter Three is to provide a common expression of the essential elements of
an effective risk assessment. It is not intended to limit organizational flexibility in conducting those assessments. Other
procedures can be implemented if organizations choose to do so, consistent with the intent of the process description.
44 The four-step risk assessment process described in this publication is consistent with the general risk assessment
process described in NIST Special Publication 800-39. The additional steps and tasks result from the need to provide
more detailed guidance to effectively carry out the specific activities associated with risk assessments.
T
Step 1: Prepare for Assessment
Derived from Organizational Risk Frame
Step 2: Conduct Assessment
Expanded Task View
Determine Likelihood of Occurrence
Identify Threat Sources and Events
Identify Vulnerabilities and
Predisposing Conditions
Determine Magnitude of Impact
Determine Risk
Step 3: Communicate Results
Step 4: Maintain Assessment
Guide for Conducting Risk Assessments
APPENDIX E > THREAT EVENTS

THREAT EVENTS

REPRESENTATIVE THREAT EVENTS INITIATED BY THREAT SOURCES
his appendix provides: (i) a description of potentially useful inputs to the threat event
identification task; (ii) representative examples of adversarial threat events expressed as
tactics, techniques, and procedures (TTPs) and non-adversarial threat events; (iii) an
exemplary assessment scale for the relevance of those threat events; and (iv) templates for
summarizing and documenting the results of the threat identification Task 2-2. Organizations can
eliminate certain threat events from further consideration if no adversary with the necessary
capability has been identified.51 Organizations can also modify the threat events provided to
describe specific TTPs with sufficient detail52 and at the appropriate classification level.53
Organizations can use the representative threat events and predicated/expected values for the
relevance of those events as a starting point with tailoring to adjust for any organization-specific
conditions. Table E-5, an output from Task 2-2, provides relevant inputs to the risk tables in
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > adequate security

adequate security: [OMB A-130] Security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > agency

agency: [OMB A-130] Any executive agency or department, military department, Federal Government corporation, Federal Government- controlled corporation, or other establishment in the Executive Branch of the Federal Government, or any independent regulatory agency.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > allocation

allocation: The process an organization employs to assign security or privacy requirements to an information system or its environment of operation; or to assign controls to specific system elements responsible for providing a security or privacy capability (e.g., router, server, remote sensor).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > assessment plan

assessment plan: The objectives for the control assessments and a detailed roadmap of how to conduct such assessments.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > assessor

assessor: The individual, group, or organization responsible for conducting a security or privacy assessment.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > assignment statement

assignment statement: A control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement (e.g., assigning a list of roles to be notified or a value for the frequency of testing). See organization-defined control parameters and selection statement.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > assurance

assurance: [ISO 15026, Adapted] Grounds for justified confidence that a [security or privacy] claim has been or will be achieved. Note 1: Assurance is typically obtained relative to a set of specific claims. The scope and focus of such claims may vary (e.g., security claims, safety claims) and the claims themselves may be interrelated. Note 2: Assurance is obtained through techniques and methods that generate credible evidence to substantiate claims.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > audit log

audit log: [CNSSI 4009] A chronological record of system activities, including records of system accesses and operations performed in a given period.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > audit trail

audit trail: A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authentication

authentication: [FIPS 200] Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authenticity

authenticity: The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. See authentication.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorization boundary

authorization boundary: [OMB A-130] All components of an information system to be authorized for operation by an authorizing official. This excludes separately authorized systems to which the information system is connected.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorization package

authorization package: [OMB A-130] The essential information that an authorizing official uses to determine whether to authorize the operation of an information system or the provision of a designated set of common controls. At a minimum, the authorization package includes an executive summary, system security plan, privacy plan, security control assessment, privacy control assessment, and any relevant plans of action and milestones.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorization to operate

authorization to operate: [OMB A-130] The official management decision given by a senior Federal official or officials to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security and privacy controls. Authorization also applies to common controls inherited by agency information systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorization to use

authorization to use: The official management decision given by an authorizing official to authorize the use of an information system, service, or application based on the information in an existing authorization package generated by another organization, and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of controls in the system, service, or application. Note: An authorization to use typically applies to cloud and shared systems, services, and applications and is employed when an organization (referred to as the customer organization) chooses to accept the information in an existing authorization package generated by another organization (referred to as the provider organization).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorizing official

authorizing official: [OMB A-130] A senior Federal official or executive with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > authorizing official designated representative

authorizing official designated representative: An organizational official acting on behalf of an authorizing official in carrying out and coordinating the required activities associated with the authorization process.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > availability

availability: [44 USC 3552] Ensuring timely and reliable access to and use of information.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > baseline configuration

baseline configuration: [SP 800-128, Adapted] A documented set of specifications for a system, or a configuration item within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > capability

capability: A combination of mutually reinforcing controls implemented by technical means, physical means, and procedural means. Such controls are typically selected to achieve a common information security or privacy purpose.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > capability requirement

capability requirement: A type of requirement describing the capability that the organization or system must provide to satisfy a stakeholder need. Note: Capability requirements related to information security and privacy are derived from stakeholder protection needs and the corresponding security and privacy requirements.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > chain of trust

chain of trust: (supply chain) A certain level of trust in supply chain interactions such that each participant in the consumer-provider relationship provides adequate protection for its component products, systems, and services.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > chief information officer

chief information officer: [OMB A-130] The senior official that provides advice and other assistance to the head of the agency and other senior management personnel of the agency to ensure that IT is acquired and information resources are managed for the agency in a manner that achieves the agency's strategic goals and information resources management goals; and is responsible for ensuring agency compliance with, and prompt, efficient, and effective implementation of, the information policies and information resources management responsibilities, including the reduction of information collection burdens on the public.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > chief information security officer

chief information security officer: See Senior Agency Information Security Officer.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > classified national security information

classified national security information: [CNSSI 4009] Information that has been determined pursuant to Executive Order (E.O.) 13526 or any predecessor order to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > commodity service

commodity service: A system service provided by a commercial service provider to a large and diverse set of consumers. The organization acquiring or receiving the commodity service possesses limited visibility into the management structure and operations of the provider, and while the organization may be able to negotiate service-level agreements, the organization is typically not able to require that the provider implement specific controls.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > common control

common control: [OMB A-130] A security or privacy control that is inherited by multiple information systems or programs.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > common control provider

common control provider: An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., controls inheritable by organizational systems).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > common criteria

common criteria: [CNSSI 4009] Governing document that provides a comprehensive, rigorous method for specifying security function and assurance requirements for products and systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > compensating controls

compensating controls: The security and privacy controls implemented in lieu of the controls in the baselines described in NIST Special Publication 800-53 that provide equivalent or comparable protection for a system or organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > confidentiality

confidentiality: [44 USC 3552] Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > configuration control

configuration control: [CNSSI 4009] Process for controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modifications before, during, and after system implementation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > configuration item

configuration item: [SP 800-128] An aggregation of system components that is designated for configuration management and treated as a single entity in the configuration management process.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > configuration management

configuration management: [SP 800-128] A collection of activities focused on establishing and maintaining the integrity of information technology products and systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > configuration settings

configuration settings: [SP 800-128] The set of parameters that can be changed in hardware, software, or firmware that affect the security posture and/or functionality of the system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > continuous monitoring

continuous monitoring: Maintaining ongoing awareness to support organizational risk decisions.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > continuous monitoring program

continuous monitoring program: A program established to collect information in accordance with preestablished metrics, utilizing information readily available in part through implemented security controls. Note: Privacy and security continuous monitoring strategies and programs can be the same or different strategies and programs.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control assessment

control assessment: The testing or evaluation of the controls in an information system or an organization to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security or privacy requirements for the system or the organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control assessor

control assessor: The individual, group, or organization responsible for conducting a control assessment. See assessor.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control baseline

control baseline: The set of controls that are applicable to information or an information system to meet legal, regulatory, or policy requirements, as well as address protection needs for the purpose of managing risk.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control designation

control designation: The process of assigning a control to one of three control types: common, hybrid, or system-specific.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control effectiveness

control effectiveness: A measure of whether a given control is contributing to the reduction of information security or privacy risk.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control enhancement

control enhancement: Augmentation of a control to build in additional, but related, functionality to the control; increase the strength of the control; or add assurance to the control.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > control inheritance

control inheritance: A situation in which a system or application receives protection from controls (or portions of controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. See common control.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > controlled unclassified information

controlled unclassified information: [32 CFR 2002.4] Information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > countermeasures

countermeasures: [FIPS 200] Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of a system. Synonymous with security controls and safeguards.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > cybersecurity

cybersecurity: [OMB A-130] Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.