ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK > TASK 1-2: Identify constraints on the conduct of risk assessment, risk response, and risk monitoring

TASK 1-2: Identify constraints on the conduct of risk assessment, risk response, and risk monitoring

activities within the organization.
Supplemental Guidance: The execution of the risk management process can be constrained in various ways, some of
which are direct and obvious, while others are indirect. Financial limitations can constrain the set of risk management
activities directly (e.g., by limiting the total resources available for investments in risk assessments or in safeguards or
countermeasures) or indirectly (e.g., by eliminating activities which, while involving relatively small investments in
risk response, entail curtailing or discarding investments in legacy information systems or information technology).
Organizations might also discover that the need to continue to depend on legacy information systems may constrain the
risk management options available to the organization. Constraints can also include legal, regulatory, and/or contractual
requirements. Such constraints can be reflected in organizational policies (e.g., restrictions on outsourcing, restrictions
on and/or requirements for information to be gathered as part of risk monitoring). Organizational culture can impose
indirect constraints on governance changes (e.g., precluding a shift from decentralized to hybrid governance structures)
and which security controls are considered by organizations as potential common controls. In particular, organizational
attitudes toward information technology risk that, for example, favor extensive automation and early adoption of new
technologies can constrain the degree of risk avoidance and perhaps risk mitigation that can be achieved. Any cultural
constraints that limit senior leader/executive (e.g., chief information officer) visibility into organizational information
systems that are beyond their formal authority (e.g. mission-related systems) may impede overall understanding of the
complexity of information systems environment and the related risks to the organization. At Tier 2, mission/business
owners interpret constraints in light of organizational missions/business functions. Some regulatory constraints may not
apply to particular missions/business functions (e.g., regulations that apply to international operations, when
mission/business areas are restricted to the United States). Alternately, additional requirements may apply (e.g.,
mission/business processes performed jointly with another organization, which imposes contractual constraints). At
Tier 3, information system owners, common control providers, and/or program managers interpret the organization-
wide and mission/business function-specific constraints with respect to their systems and environments of operation
(e.g., requirements to provide specific security controls are satisfied through common controls).
RISK TOLERANCE
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK > TASK 1-3: Identify the level of risk tolerance for the organization.

TASK 1-3: Identify the level of risk tolerance for the organization.

Supplemental Guidance: Risk tolerance is the level of risk that organizations are willing to accept in pursuit of strategic
goals and objectives. Organizations define information security-related risk tolerance organization-wide considering all
missions/business functions. Organizations can use a variety of techniques for identifying information security risk
tolerance (e.g., by establishing zones in a likelihood-impact trade space or by using a set of representative scenarios).
Organizations also define tolerance for other types of organizational and operational risks (e.g., financial, risk, safety
risk, compliance risk, or reputation risk). At Tier 2, mission/business owners may have different risk tolerances from
the organization as a whole. The risk executive (function) provides organizations with ways to resolve such differences
in risk tolerances at Tier 2. The level of residual risk accepted by authorizing officials for information systems or
inherited common controls is within the organizational risk tolerance, and not the individual risk tolerances of those
authorizing officials. In addition, organizations provide to Tier 2 and Tier 3, guidance on evaluating risk for specific
mission/business processes or information systems and a focus on near-term mission/business effectiveness with the
longer-term, strategic focus of the organizational risk tolerance. See Section 2.3.3 for additional information on risk
tolerance.
PRIORITIES AND TRADE-OFFS
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK > TASK 1-4: Identify priorities and trade-offs considered by the organization in managing risk.

TASK 1-4: Identify priorities and trade-offs considered by the organization in managing risk.

Supplemental Guidance: Risk is experienced at different levels, in different forms, and in different time frames. At Tier
1, organizations make trade-offs among and establish priorities for responding to such risks. Organizations tend to have
multiple priorities that at times conflict, which generates potential risk. Approaches employed by organizations for
managing portfolios of risks reflect organizational culture, risk tolerance, as well as risk-related assumptions and
constraints. These approaches are typically embodied in the strategic plans, policies, and roadmaps of organizations
which may indicate preferences for different forms of risk response. For example, organizations may be willing to
accept short-term risk of slightly degraded operations to achieve long-term reduction in information security risk.
However, this trade-off could be unacceptable for one particularly critical mission/business function (e.g., real-time
requirements in many industrial/process control systems). For that high-priority area, a different approach to improving
security may be required including the application of compensating security controls.
Outputs and Post Conditions
The output of the risk framing step is the risk management strategy that identifies how organizations intend to assess,
respond to, and monitor risk over time. The framing step also produces a set of organizational policies, procedures,
standards, guidance, and resources covering the following topics: (i) scope of the organizational risk management
process (e.g., organizational entities covered; mission/business functions affected; how risk management activities are
applied within the risk management tiers); (ii) risk assessment guidance including, for example, the characterization of
threat sources, sources of threat information, representative threat events (in particular, adversary tactics, techniques,
and procedures), when to consider and how to evaluate threats, sources of vulnerability information, risk assessment
methodologies to be used, and risk assumptions; (iii) risk response guidance including, for example, risk tolerances,
risk response concepts to be employed, opportunity costs, trade-offs, consequences of responses, hierarchy of
authorities, and priorities; (iv) risk monitoring guidance, including, for example, guidance on analysis of monitored risk
factors to determine changes in risk, and monitoring frequency, methods, and reporting; (v) other and risk constraints
on executing risk management activities; and (vi) organizational priorities and trade-offs. Outputs from the risk framing
step serve as inputs to the risk assessment, risk response, and risk monitoring steps.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX E > RISK MANAGEMENT PROCESS TASKS > TASK 2-2

RISK MANAGEMENT PROCESS TASKS

SUMMARY OF TASKS FOR STEPS IN THE RISK MANAGEMENT PROCESS
TASK

TASK 1-1

RISK ASSUMPTIONS
Identify assumptions that affect how risk is assessed, responded to, and monitored
within the organization.

TASK 1-2

RISK CONSTRAINTS
Identify constraints on the conduct of risk assessment, risk response, and risk
monitoring activities within the organization.

TASK 1-3

RISK TOLERANCE
Identify the level of risk tolerance for the organization.

TASK 1-4

PRIORITIES AND TRADE-OFFS
Identify priorities and trade-offs considered by the organization in managing risk.
Step 2: Risk Assessment

TASK 2-1

THREAT AND VULNERABILITY
IDENTIFICATION
Identify threats to and vulnerabilities in organizational information systems and the
environments in which the systems operate.

TASK 2-2

RISK DETERMINATION
Determine the risk to organizational operations and assets, individuals, other
organizations, and the Nation if identified threats exploit identified vulnerabilities.
Step 3: Risk Response
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.2 ASSESSING RISK > TASK 2-2: Determine the risk to organizational operations and assets, individuals, other organizations, and (part 2)

Based on the course
of action selected during the risk response step, some residual risk may remain. Under certain circumstances, the level
of residual risk could trigger a reassessment of risk. This reassessment is typically incremental (assessing only the new
information) and differential (assessing how the new information changes the overall risk determination). The aggregation of risk assessment results from all three tiers drives the management of portfolios of risks undertaken
by organizations. Identified risks common to more than one mission/business function within organizations may also be
the source for future assessment activities at Tier 1, such as root-cause analysis. Gaining a better understanding of the
reasons why certain risks are more common or frequent assists decision makers in selecting risk responses that address
underlying (or root-cause) problems instead of solely focusing on the surface issues surrounding the existence of the
risks. The results of risk assessments can also shape future design and development decisions related to enterprise
architecture (including embedded information security architecture), and organizational information systems. The
extent to which missions/business functions are vulnerable to a set of identified threats and the relative ease with which
those vulnerabilities can be exploited, contribute to the risk-related information provided to senior leaders/executives. Outputs from the risk assessment step can be useful inputs to the risk framing and risk monitoring steps. For example,
risk determinations can result in revisiting the organizational risk tolerance established during the risk framing step. Organizations can also choose to use information from the risk assessment step to inform the risk monitoring step. For
example, risk assessments can include recommendations to monitor specific elements of risk (e.g., threat sources) so
that if certain thresholds are crossed, previous risk assessment results can be reviewed and updated, as appropriate. Particular thresholds established as part of risk monitoring programs can also serve as the basis for reassessments of
risk. If organizations establish criteria as a part of the risk framing step for when risk assessment results do not warrant
risk responses, then assessment results could be fed directly to the risk monitoring step as a source of input.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > TASK 3-3: Decide on the appropriate course of action for responding to risk.

TASK 3-3: Decide on the appropriate course of action for responding to risk.

Supplemental Guidance: Decisions on the most appropriate course of action include some form of prioritization. Some
risks may be of greater concern than other risks. In that case, more resources may need to be directed at addressing
higher-priority risks than at other lower-priority risks. This does not necessarily mean that the lower-priority risks
would not be addressed. Rather, it could mean that fewer resources might be directed at the lower-priority risks (at least
initially), or that the lower-priority risks would be addressed at a later time. A key part of the risk decision process is
the recognition that regardless of the decision, there still remains a degree of residual risk that must be addressed.
Organizations determine acceptable degrees of residual risk based on organizational risk tolerance and the specific risk
tolerances of particular decision makers. Impacting the decision process are some of the more intangible risk-related
concepts (e.g., risk tolerance, trust, and culture). The specific beliefs and approaches that organizations embrace with
respect to these risk-related concepts affect the course of action selected by decision-makers.
RISK RESPONSE IMPLEMENTATION
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > 3.4 MONITORING RISK > TASK 4-1: Develop a risk monitoring strategy for the organization that includes the purpose, type, and (part 3)

While automation
can be a supporting capability for Tiers 1 and 2, generally automation does not provide substantive insight for non-
information technology-based activities which are more prevalent at those higher tiers. Activities that are not as likely
to benefit from automation include, for example, the use of multiple suppliers within the supply chain, evolving
environments of operation, or evaluating the promise of emerging technical capabilities in support of missions/business
functions. Where automated monitoring is not available, organizations employ manual monitoring and/or analysis. Frequency of Monitoring
The frequency of risk monitoring (whether automated or manual) is driven by organizational missions/business
functions and the ability of organizations to use the monitoring results to facilitate greater situational awareness. An
increased level of situational awareness of the security state of organizational information systems and environments of
operation helps organizations develop a better understanding of risk. Monitoring frequency is also driven by other
factors, for example: (i) the anticipated frequency of changes in organizational information systems and operating
environments; (ii) the potential impact of risk if not properly addressed through appropriate response measures; and
(iii) the degree to which the threat space is changing. The frequency of monitoring can also be affected by the type of
monitoring conducted (i.e., automated versus procedural approaches). Depending on the frequency of monitoring
required by organizations, in most situations, monitoring is most efficient and cost-effective when automation is
employed. Monitoring can provide significant benefits, especially in situations where such monitoring limits the
opportunities for adversaries to gain a foothold within organizations (either through information systems or the
environments in which those systems operate). When manual monitoring is employed by organizations, it is generally
not efficient to perform the monitoring with the frequency that automation allows. In some instances, infrequent
monitoring is not a major issue. For example, missions/business functions, facilities, legislation, policies, and
technologies tend to change on a more gradual basis and as such, do not lend themselves to frequent monitoring. Instead, these types of changes are better suited to condition/event-based monitoring (e.g., if missions and/or business
functions change, then monitoring of such changes is appropriate to determine if the changes have any impact on risk). RISK MONITORING
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX E > RISK MANAGEMENT PROCESS TASKS > TASK 4-2

TASK 3-1

RISK RESPONSE IDENTIFICATION
Identify alternative courses of action to respond to risk determined during the risk
assessment.

TASK 3-2

EVALUATION OF ALTERNATIVES
Evaluate alternative courses of action for responding to risk.

TASK 3-3

RISK RESPONSE DECISION
Decide on the appropriate course of action for responding to risk.

TASK 3-4

RISK RESPONSE IMPLEMENTATION
Implement the course of action selected to respond to risk.
Step 4: Risk Monitoring

TASK 4-1

RISK MONITORING STRATEGY
Develop a risk monitoring strategy for the organization that includes the purpose, type,
and frequency of monitoring activities.

TASK 4-2

RISK MONITORING
Monitor organizational information systems and environments of operation on an
ongoing basis to verify compliance, determine effectiveness of risk response
measures, and identify changes.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > THE FUNDAMENTALS

THE FUNDAMENTALS

BASIC CONCEPTS ASSOCIATED WITH RISK MANAGEMENT
T
his chapter describes the fundamental concepts associated with managing information
security risk across an organization including: (i) the components of risk management; (ii)
the multitiered risk management approach; (iii) risk management at Tier 1 (organization
level); (iv) risk management at Tier 2 (mission/business process level); (v) risk management at
Tier 3 (information system level); (vi) risk related to trust and trustworthiness; (vii) the effects of
organizational culture on risk; and (viii) the relationships among key risk management concepts.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > TIER 3

TIER 3

INFORMATION SYSTEMS
- Inter- Tier and Intra-Tier
Communications
- Feedback Loop for
Continuous Improvement
- Traceability and Transparency of
Risk-Based Decisions
- Organization-Wide
Risk Awareness
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > TRUST MODELS

TRUST MODELS

APPROACHES TO ESTABLISHING TRUST RELATIONSIPS
T
he following trust models describe ways in which organizations can obtain the levels of
trust needed to form partnerships, collaborate with other organizations, share information,
or receive information system/security services. No single trust model is inherently better
than any other model. Rather, each model provides organizations with certain advantages and
disadvantages based on their circumstances (e.g., governance structure, risk tolerance, and
criticality/sensitivity of organizational missions and business processes).
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > TRUST MODELS > Validated Trust

Validated Trust

In the validated trust model, one organization obtains a body of evidence regarding the actions of
another organization (e.g., the organization's information security policies, activities, and risk-
related decisions) and uses that evidence to establish a level of trust with the other organization.
An example of validated trust is where one organization develops an application or information
system and provides evidence (e.g., security plan, assessment results) to a second organization
that supports the claims by the first organization that the application/system meets certain security
requirements and/or addresses the appropriate security controls in NIST Special Publication 800
53. Validated trust may not be sufficient-that is, the evidence offered by the first organization to
the second organization may not fully satisfy the second organization's trust requirements or trust
expectations. The more evidence provided between organizations as well as the quality of such
evidence, the greater the degree of trust that can be achieved. Trust is linked to the degree of
transparency between the two organizations with regard to risk and information security-related
activities and decisions.
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-1 > Assessment Methods

AC-1 Policy and Procedures - Assessment Methods and Objects

Examine: Access control policy and procedures

system security plan

privacy plan

other relevant documents or records

Interview: Organizational personnel with access control responsibilities

organizational personnel with information security with information security and privacy responsibilities
Assessing Security and Privacy Controls in Information Systems and Organizations
AC > AC-1 > Assessment Objective

AC-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

AC-01a.[01] an access control policy is developed and documented;
AC-01a.[02] the access control policy is disseminated to [Assignment: organization-defined personnel or roles];
AC-01a.[03] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;
AC-01a.[04] the access control procedures are disseminated to [Assignment: organization-defined personnel or roles];
AC-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses purpose;
AC-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses scope;
AC-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses roles;
AC-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses responsibilities;
AC-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses management commitment;
AC-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities;
AC-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy addresses compliance;
AC-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
AC-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures;
AC-01c.01[01] the current access control policy is reviewed and updated [Assignment: organization-defined frequency];
AC-01c.01[02] the current access control policy is reviewed and updated following [Assignment: organization-defined events];
AC-01c.02[01] the current access control procedures are reviewed and updated [Assignment: organization-defined frequency];
AC-01c.02[02] the current access control procedures are reviewed and updated following [Assignment: organization-defined events].