ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
APPENDIX I

TABLE I-6: COLUMN DESCRIPTIONS FOR NON-ADVERSARIAL RISK TABLE
Column
Heading
Content
Threat Event
Identify threat event. (Task 2-2; Table E-1; Table E-3; Table E-5; Table I-7.)
Threat Sources
Identify threat sources that could initiate the threat event. (Task 2-1; Table D-1; Table D-2;
Table D-8; Table I-7.)
Range of Effects
Identify the range of effects from the threat source. (Task 2-1; Table D-1; Table D-6; Table I-7.)
Relevance
Determine relevance of threat event. (Task 2-2; Table E-1; Table E-4; Table E-5; Table I-7.)
If the relevance of the threat event does not meet the organization's criteria for further
consideration, do not complete the remaining columns.
Likelihood of Threat Event
Occurring
Determine the likelihood that the threat event will occur. (Task 2-4; Table G-1; Table G-3; Table
I-7.)
Vulnerabilities and
Predisposing Conditions
Identify vulnerabilities which could be exploited by threat sources initiating the threat event and
the predisposing conditions which could increase the likelihood of adverse impacts. (Task 2-5;
Table F-1; Table F-3; Table F-4; Table F-6; Table I-7.)
Severity
Pervasiveness
Assess severity of vulnerabilities and pervasiveness of predisposing conditions. (Task 2-5; Table
F-1; Table F-2; Table F-5; Table F-6; Table I-5.)
Likelihood Threat Event
Results in Adverse Impact
Determine the likelihood that the threat event, once initiated, will result in adverse impact, taking
into consideration vulnerabilities and predisposing conditions. (Task 2-4; Table G-1; Table G-4;
Table I-7.)
Overall Likelihood
Determine the likelihood that the threat event will occur and result in adverse impacts (i.e.,
combination of likelihood of threat occurring and likelihood that the threat event results in
adverse impact). (Task 2-4; Table G-1; Table G-5; Table I-7.)
Level of Impact
Determine the adverse impact (i.e., potential harm to organizational operations, organizational
assets, individuals, other organizations, or the Nation) from the threat event. (Task 2-5; Table H-
1, Table H-2; Table H-3; Table H-4; Table I-7.)
Risk
Determine the level of risk as a combination of likelihood and impact. (Task 2-6; Table I-1; Table
I-2; Table I-3; Table I-7.)
TABLE I-7: TEMPLATE - NON-ADVERSARIAL RISK
Threat
Event
Threat
Sources
Range
of
Effects
Relevance
Likelihood of
Event Occurring
Vulnerabilities
and
Predisposing
Conditions
Severity and
Pervasiveness
Likelihood Event
Results in Adverse
Impact
Overall Likelihood
Level
of
Impact
Risk
Guide for Conducting Risk Assessments
Appendix I.

Appendix I.

TABLE E-1: INPUTS - THREAT EVENT IDENTIFICATION
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1: (Organization level)
- Sources of threat information deemed to be credible (e.g., open source and/or classified threat
reports, previous risk/threat assessments. (Section 3.1, Task 1-4.)
- Threat event information and guidance specific to Tier 1 (e.g., threats related to organizational
governance, core missions/business functions, external mission/business relationships,
management/operational policies, procedures, and structures).
- Exemplary adversarial threat events, annotated by the organization, if necessary. (Table E-2)
- Exemplary non-adversarial threat events, annotated by the organization, if necessary. (Table E-3)
- Assessment scale for assessing the relevance of threat events, annotated by the organization, if
necessary. (Table E-4)
- Threat events identified in previous risk assessments, if appropriate.
No
Yes
Yes
If not
provided
by Tier 2
From Tier 2: (Mission/business process level)
- Threat event information and guidance specific to Tier 2 (e.g., threats related to mission/business
processes, EA segments, common infrastructure, support services, common controls, and external
dependencies).
- Mission/business process-specific characterization of adversarial and non-adversarial threat events.
Yes
Via
RAR
Yes
Via
Peer
Sharing
Yes
From Tier 3: (Information system level)
- Threat event information and guidance specific to Tier 3 (e.g., threats related to information systems,
information technologies, information system components, applications, networks, environments of
operation).
- Information system-specific characterization of adversarial and non-adversarial threat events.
- Incident reports.
Yes
Via
RAR
Yes
Via
RAR
Yes
Via
Peer
Sharing
51 Each entry in Table E-2 implicitly assumes a level of adversary capability, intent, and targeting. Depending on the
results of threat source identification, some entries could be determined to be irrelevant, while other entries could be
combined. In addition, some entries could be rewritten in terms of an organization's enterprise architecture.
52 The level of detail of TTPs is established as part of the organizational risk frame. The level of detail in Table E-2 is
intended to support risk assessments at all three tiers, and to be tailorable to include additional details, as necessary.
More detailed descriptions of threat events that exploit software, for example, can be found in the Common Attack
Pattern Enumeration and Classification (CAPEC) site at http://capec.mitre.org.
53 The threat events in Table E-2 are provided at the unclassified level. Additional threat events at the classified level
are available from selected federal agencies to individuals with appropriate security clearances and need to know.
T
Guide for Conducting Risk Assessments
APPENDIX J

Synergies Among Risks
If a risk materializes that is closely related to multiple risks, it is likely that a cluster of risks will
materialize at or near the same time. Managing the adverse impact from one risk materializing
may be possible; managing multiple risks of high impact that materialize at the same time may
challenge the capacity of the organization and therefore needs to be managed much more closely.
The following questions address relationships among risks.
Will the materialization of a particular risk result in:
•
A high likelihood or virtual certainty of other identified risks materializing?
•
A high likelihood or virtual certainty of other identified risks not materializing?
•
No particular effect on other identified risks materializing?
If a risk is highly coupled to other risks or seen as likely to lead to other risks materializing
(whether the risk is the cause or materializes concurrently), the risk should be given higher
priority than a risk that has no particular effect on other risks. If a risk materializing actually
decreases the likelihood of other risks materializing, then further analysis is warranted to
determine which risks become a lower priority to mitigate.
In conclusion, organizations can benefit significantly by refining risk assessment results in
preparation for the risk response step in the risk management process. During the risk response
step, which is described in NIST Special Publication 800-39, organizations: (i) analyze different
courses of action; (ii) conduct cost-benefit analyses; (iii) address scalability issues for large-scale
implementations; (iv) examine the interactions/dependencies among risk mitigation approaches
(e.g., dependencies among security controls); and (v) assess other factors affecting organizational
missions/business functions. In addition, organizations address cost, schedule, and performance
issues associated with information systems and information technology infrastructure supporting
organizational missions/business functions.
CAUTIONARY NOTE
Organizations are cautioned that risk assessments are often not precise instruments of measurement
and reflect the limitations of the specific assessment methodologies, tools, and techniques employed-
as well as the subjectivity, quality, and trustworthiness of the data used. Risk determinations may be
very coarse due to the assessment approach selected, the uncertainty in the likelihood of occurrence
and impact values, and the potential mischaracterization of threats. Risks that are on the borderline
between bins using the organization-defined binning scales, must ultimately be assigned to one bin.
This determination could have a significant effect on the risk prioritization process. Thus, organizations
should incorporate as much information as practical on particular risks during the prioritization process
to ensure that the values for risks are appropriately determined (e.g., very low, low, moderate, high, very
high).
Guide for Conducting Risk Assessments
APPENDIX K

-
How the use of a specific information technology would potentially change the risk
to organizational missions/business functions if employed in information systems
supporting those missions/business functions; or
-
How the risk assessment results are to be used in the context of the RMF (e.g., an
initial risk assessment to be used in tailoring security control baselines and/or to
guide and inform other decisions and serve as a starting point for subsequent risk
assessments; subsequent risk assessment to incorporate results of security control
assessments and inform authorization decisions; subsequent risk assessment to
support the analysis of alternative courses of action for risk responses; subsequent
risk assessment based on risk monitoring to identify new threats or vulnerabilities;
subsequent risk assessments to incorporate knowledge gained from incidents or
attacks).
•
Identify assumptions and constraints.
•
Describe risk tolerance inputs to the risk assessment (including the range of consequences
to be considered).
•
Identify and describe the risk model and analytic approach; provide a reference or include
as an appendix, identifying risk factors, value scales, and algorithms for combining
values.
•
Provide a rationale for any risk-related decisions during the risk assessment process.
•
Describe the uncertainties within the risk assessment process and how those uncertainties
influence decisions.
•
If the risk assessment includes organizational missions/business functions, describe the
missions/functions (e.g., mission/business processes supporting the missions/functions,
interconnections and dependencies among related missions/business functions, and
information technology that supports the missions/business functions).
•
If the risk assessment includes organizational information systems, describe the systems
(e.g., missions/business functions the system is supporting, information flows to/from the
systems, and dependencies on other systems, shared services, or common infrastructures).
•
Summarize risk assessment results (e.g., using tables or graphs), in a form that enables
decision makers to quickly understand the risk (e.g., number of threat events for different
combinations of likelihood and impact, the relative proportion of threat events at different
risk levels).
•
Identify the time frame for which the risk assessment is valid (i.e., time frame for which
the assessment is intended to support decisions).
•
List the risks due to adversarial threats (see Table F-1).
•
List the risks due to non-adversarial threats (see Table F-2).
Guide for Conducting Risk Assessments
APPENDIX K > RISK ASSESSMENT REPORTS > Body of the Report

Body of the Report

•
Describe the purpose of the risk assessment, including questions to be answered by the
assessment. For example:
57 The essential elements of information described in this appendix are informative and exemplary only and are not
intended to require or promote a specific template for documenting risk assessment results. Organizations have
maximum flexibility in determining the type and the level of detail of information included in organizational risk
assessments and the associated reports. For example, Tier 1 and Tier 2 risk assessment results may be conveyed via an
executive briefing or dashboard, whereas Tier 3 risk assessment results may be conveyed via a risk assessment report
(formal or informal depending on organizational preference). The essential elements of information for communicating
risk assessment results can be modified accordingly to meet the needs of organizations conducting the assessments.
T
Guide for Conducting Risk Assessments
CHAPTER 1

•
Individuals with information security/risk assessment and monitoring responsibilities (e.g.,
system evaluators, penetration testers, security control assessors, risk assessors, independent
verifiers/validators, inspectors general, auditors).
Guide for Conducting Risk Assessments
CHAPTER 2

Risk assessments address the potential adverse impacts to organizational operations and assets,
individuals, other organizations, and the economic and national security interests of the United
States, arising from the operation and use of information systems and the information processed,
stored, and transmitted by those systems. Organizations conduct risk assessments to determine
risks that are common to the organization's core missions/business functions, mission/business
processes, mission/business segments, common infrastructure/support services, or information
systems. Risk assessments can support a wide variety of risk-based decisions and activities by
organizational officials across all three tiers in the risk management hierarchy including, but not
limited to, the following:
• Development of an information security architecture;
• Definition of interconnection requirements for information systems (including systems
supporting mission/business processes and common infrastructure/support services);
• Design of security solutions for information systems and environments of operation including
selection of security controls, information technology products, suppliers/supply chain, and
contractors;
• Authorization (or denial of authorization) to operate information systems or to use security
controls inherited by those systems (i.e., common controls);
• Modification of missions/business functions and/or mission/business processes permanently,
or for a specific time frame (e.g., until a newly discovered threat or vulnerability is addressed,
until a compensating control is replaced);
• Implementation of security solutions (e.g., whether specific information technology products
or configurations for those products meet established requirements); and
• Operation and maintenance of security solutions (e.g., continuous monitoring strategies and
programs, ongoing authorizations).
Because organizational missions and business functions, supporting mission/business processes,
information systems, threats, and environments of operation tend to change over time, the validity
and usefulness of any risk assessment is bounded in time.
Guide for Conducting Risk Assessments
CHAPTER 2

Strategic plans and policies also assert or imply the relative priorities of immediate or near-term
mission/business function accomplishment and long-term organizational viability (which can be
undermined by the loss of reputation or by sanctions resulting from the compromise of sensitive
information). Organizations can also consider the range of effects of threat events including the
relative size of the set of resources affected, when making final impact determinations. Risk
tolerance assumptions may state that threat events with an impact below a specific value do not
warrant further analysis.
Risk
Figure 3 illustrates an example of a risk model including the key risk factors discussed above and
the relationship among the factors. Each of the risk factors is used in the risk assessment process
in Chapter Three.
FIGURE 3: GENERIC RISK MODEL WITH KEY RISK FACTORS
As noted above, risk is a function of the likelihood of a threat event's occurrence and potential
adverse impact should the event occur. This definition accommodates many types of adverse
impacts at all tiers in the risk management hierarchy described in Special Publication 800-39
(e.g., damage to image or reputation of the organization or financial loss at Tier 1; inability to
successfully execute a specific mission/business process at Tier 2; or the resources expended in
responding to an information system incident at Tier 3). It also accommodates relationships
among impacts (e.g., loss of current or future mission/business effectiveness due to the loss of
data confidentiality; loss of confidence in critical information due to loss of data or system
integrity; or unavailability or degradation of information or information systems). This broad
definition also allows risk to be represented as a single value or as a vector (i.e., multiple values),
in which different types of impacts are assessed separately. For purposes of risk communication,
risk is generally grouped according to the types of adverse impacts (and possibly the time frames
in which those impacts are likely to be experienced).
Risk Framing
producing
with Severity
Vulnerability
In the context of
with
Pervasiveness
Predisposing
Conditions
Security Controls
Planned / Implemented
with
Effectiveness
with
Characteristics
(e.g., Capability, Intent, and
Targeting for Adversarial
Threats)
with
Likelihood of
Initiation
with
Likelihood of
Success
Threat
Source
initiates
Threat
Event
exploits
with Risk
as a combination of
Impact and Likelihood
with
Degree
Adverse
Impact
causing
with
Sequence of
actions, activities,
or scenarios
ORGANIZATIONAL RISK
To organizational operations (mission,
functions, image, reputation), organizational
assets, individuals, other organizations, and
the Nation.
Inputs from Risk Framing Step
(Risk Management Strategy or Approach)
Influencing and Potentially Modifying Key
Risk Factors
Guide for Conducting Risk Assessments
CHAPTER 2

TIER 3

INFORMATION SYSTEMS
- Inter-Tier and Intra-Tier
Communications
- Feedback Loop for
Continuous Improvement

STRATEGIC RISK

- Traceability and Transparency of
Risk-Based Decisions
- Organization-Wide
Risk Awareness

Risk assessments can also inform other risk management activities across the three tiers that are
not security-related. For example, at Tier 1, risk assessments can provide useful inputs to: (i)
operational risk determinations (including business continuity for organizational missions and
business functions); (ii) organizational risk determinations (including financial risk, compliance
risk, regulatory risk, reputation risk, and cumulative acquisition risk across large-scale projects);
and (iii) multiple-impact risk (including supply chain risk and risk involving partnerships). At
Tier 2, risk assessments can provide the same useful inputs to operational, organizational, and
multiple-impact risks, specific to mission/business processes. At Tier 3, risk assessments can
inform assessments of cost, schedule, and performance risks associated with information systems,
with information security experts coordinating with program managers, information system
owners, and authorizing officials. This type of coordination is essential within organizations in
order to eliminate silos and/or stove-piped activities that produce less than optimal or inefficient
information technology and security solutions-thus affecting the ability of organizations to carry
out assigned missions/business functions with maximum efficiency and cost-effectiveness.
It is important to note that information security risk contributes to non-security risks at each tier.
Thus, the results of a risk assessment at a given tier serve as inputs to, and are aligned with, non-
security risk management activities at that tier.35 In addition, the results of risk assessments at
lower tiers serve as inputs to risk assessments at higher tiers. Risks can arise on different time
scales (e.g., the disclosure of information about current organizational operations can compromise
the effectiveness of those operations immediately, while the disclosure of strategic planning
information can compromise future operational capabilities). Risk response decisions can also
take effect in different time frames (e.g., changes in organizational policies or investment
strategies can sometimes require years to take effect, while configuration changes in an individual
system can often be implemented immediately). In general, the risk management process tends to
move more slowly at Tiers 1 and 2 than at Tier 3. This is due to how organizations typically
respond to risks that potentially affect widespread organizational operations and assets-where
such risk responses may need to address systemic or institutional issues. However, some Tier 1
decisions (e.g., newly discovered threats or vulnerabilities requiring the implementation of an
organization-wide mandate for mitigation) can involve immediate action.
Guide for Conducting Risk Assessments
CHAPTER 3

Sharing Environment [DCISE], Information Sharing and Analysis Centers [ISACs] for critical infrastructure sectors),
research and nongovernmental organizations (e.g. Carnegie Mellon University, Software Engineering Institute-CERT),
and security service providers). Organizations using external sources, consider the timeliness, specificity, and relevance
of threat information. Similar to sources of threat information, sources of vulnerability information can also be either
internal or external to organizations (see Table F-1). Internal sources can include, for example, vulnerability assessment
reports. External sources of vulnerability information are similar to the sources identified above for threat information.
As described in Table F-1, information about predisposing conditions can be found in a variety of sources including,
for example, descriptions of information systems, environments of operation, shared services, common infrastructures,
and enterprise architecture. As described in Table H-1, sources of impact information can include, for example,
mission/business impact analyses, information system component inventories, and security categorizations. Security
categorization constitutes a determination of the potential impacts should certain events occur which jeopardize the
information and information systems needed by the organization to accomplish its assigned missions, protect its assets,
fulfill its legal responsibilities, maintain its day-to-day functions, and protect individuals. Security categories are to be
used in conjunction with vulnerability and threat information in assessing the risk to organizational operations and
assets, individuals, other organizations, and the Nation. Security categories constitute an initial summary of impact in
terms of failures to meet the security objectives of confidentiality, integrity, and availability, and are informed by the
types of harm presented in Table H-2.
IDENTIFY RISK MODEL AND ANALYTIC APPROACH
Guide for Conducting Risk Assessments
CHAPTER 3

The overall likelihood of a threat event is a combination of: (i) the likelihood that the event will occur (e.g., due to
human error or natural disaster) or be initiated by an adversary; and (ii) the likelihood that the initiation/occurrence will
result in adverse impacts. Organizations assess the overall likelihood of threat events by using inputs from Tables G-2,
G-3, and G-4. Any specific algorithm or rule for combining the determined likelihood values depends on: (i) general
organizational attitudes toward risk, including overall risk tolerance and tolerance for uncertainty; (ii) specific
tolerances toward uncertainty in different risk factors; and (iii) organizational weighting of risk factors. For example,
organizations could use any of the following rules (or could define a different rule): (i) use the maximum of the two
likelihood values; (ii) use the minimum of the two likelihood values; (iii) consider likelihood of initiation/occurrence
only, assuming that if threat events are initiated or occur, the events will result in adverse impacts; (iv) consider
likelihood of impact only, assuming that if threat events could result in adverse impacts, adversaries will initiate the
events; or (v) take a weighted average of the two likelihood values. Organizations make explicit the rules used.