Guide for Conducting Risk Assessments
APPENDIX F > VULNERABILITIES AND PREDISPOSING CONDITIONS

VULNERABILITIES AND PREDISPOSING CONDITIONS

RISK FACTORS AFFECTING THE LIKELIHOOD OF SUCCESSFUL THREAT EXPLOITATION
his appendix provides: (i) a description of potentially useful inputs to the vulnerability and
predisposing condition identification task; (ii) an exemplary taxonomy of predisposing
conditions; (iii) exemplary assessment scales for assessing the severity of vulnerabilities
and the pervasiveness of predisposing conditions; and (iv) a set of templates for summarizing and
documenting the results of the vulnerability and predisposing condition identification task. The
taxonomy and assessment scales in this appendix can be used by organizations as a starting point
with appropriate tailoring to adjust for any organization-specific conditions. Tables F-3 and F-6,
outputs from Task 2-3, provide relevant inputs to the risk tables in Appendix I.
TABLE F-1: INPUTS - VULNERABILITIES AND PREDISPOSING CONDITIONS
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1 (Organization level)
- Sources of vulnerability information deemed to be credible (e.g., open source and/or classified
vulnerabilities, previous risk/vulnerability assessments, Mission and/or Business Impact Analyses).
(Section 3.1, Task 1-4.)
- Vulnerability information and guidance specific to Tier 1 (e.g., vulnerabilities related to organizational
governance, core missions/business functions, management/operational policies, procedures, and
structures, external mission/business relationships).
- Taxonomy of predisposing conditions, annotated by the organization, if necessary. (Table F-4)
- Characterization of vulnerabilities and predisposing conditions.
- Assessment scale for assessing the severity of vulnerabilities, annotated by the organization, if
necessary. (Table F-2)
- Assessment scale for assessing the pervasiveness of predisposing conditions, annotated by the
organization, if necessary. (Table F-5)
- Business Continuity Plan, Continuity of Operations Plan for the organization, if such plans are
defined for the entire organization.
No
Yes
Yes
If not
provided
by Tier 2
From Tier 2: (Mission/business process level)
- Vulnerability information and guidance specific to Tier 2 (e.g., vulnerabilities related to organizational
mission/business processes, EA segments, common infrastructure, support services, common
controls, and external dependencies).
- Business Continuity Plans, Continuity of Operations Plans for mission/business processes, if such
plans are defined for individual processes or business units.
Yes
Via
RAR
Yes
Via
Peer
Sharing
Yes
From Tier 3: (Information system level)
- Vulnerability information and guidance specific to Tier 3 (e.g., vulnerabilities related to information
systems, information technologies, information system components, applications, networks,
environments of operation).
- Security assessment reports (i.e., deficiencies in assessed controls identified as vulnerabilities).
- Results of monitoring activities (e.g., automated and nonautomated data feeds).
- Vulnerability assessments, Red Team reports, or other reports from analyses of information systems,
subsystems, information technology products, devices, networks, or applications.
- Contingency Plans, Disaster Recovery Plans, Incident Reports.
- Vendor/manufacturer vulnerability reports.
Yes
Via
RAR
Yes
Via
RAR
Yes
Via
Peer
Sharing
T