Guide for Conducting Risk Assessments
CHAPTER 2 > 2.4.4 Risk Communications and Information Sharing

2.4.4 Risk Communications and Information Sharing

The risk assessment process entails ongoing communications and information sharing among
stakeholders to ensure that: (i) the inputs to such assessments are as accurate as possible; (ii)
intermediate assessment results can be used, for example, to support risk assessments at other
tiers; and (iii) the results are meaningful and useful inputs to the risk response step in the risk
management process. The manner and form in which risks are communicated are an expression
of organizational culture as well as legal, regulatory, and contractual constraints. To be effective,
communication of information security risks and other risk-related information produced during
the risk assessment is consistent with other forms of risk communication within organizations. To
maximize the benefit of risk assessments, organizations should establish policies, procedures, and
implementing mechanisms to ensure that the information produced during such assessments is
effectively communicated and shared across all three risk management tiers.42 To reinforce the
importance of risk communication and information sharing within organizations, the input tables
in Appendices D, E, F, G, H, and I (i.e., threat sources, threat events, vulnerabilities, predisposing
conditions, likelihood, impact, and risk) and the recommended elements of a risk assessment
report (Appendix K) provide recommendations for risk communication/sharing among the tiers.
42 NIST Special Publications 800-117 and 800-126 provide guidance on the Security Content Automation Protocol
(SCAP) program. The SCAP program provides a standard, consistent way to communicate threat and vulnerability
information.
TARGETED RISK ASSESSMENTS
Organizations can use targeted risk assessments, in which the scope is narrowly defined, to produce
answers to specific questions (e.g., what is the risk associated with relying on a given technology, how
should prior assessments of risk be revised based on incidents that have occurred, what new risks can
be identified based on knowledge about a newly discovered threat or vulnerability) or to inform specific
decisions (e.g., which risks should be managed at Tier 1 rather than Tier 2 or 3). Organizations may
consider assessing risk at Tier 1 and Tier 2 arising from a set of common threats and vulnerabilities
applicable to a wide range of organizational information systems. Assessing risk at Tiers 1 and 2 allows
organizations to reduce the number of threats and vulnerabilities considered at the individual information
system level and develop common risk responses for such organization-wide risks. This approach can
support the common control selection process for organizations and increase the efficiency and cost-
effectiveness of risk assessments across the organization.
With respect to all three tiers in the risk management hierarchy, there are no specific requirements
with regard to: (i) the formality, rigor, or level of detail that characterizes any particular risk assessment;
(ii) the methodologies, tools, and techniques used to conduct such risk assessments; or (iii) the format
and content of assessment results and any associated reporting mechanisms. Organizations have
maximum flexibility on how risk assessments are conducted, where such assessments are applied,
and how the results will be used. Organizations are encouraged to use the guidance in a manner that
most effectively and cost-effectively provides the information necessary to senior leaders/executives to
facilitate informed risk management decisions.