ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 1-3: Identify the specific assumptions and constraints under which the risk assessment is conducted.

TASK 1-3: Identify the specific assumptions and constraints under which the risk assessment is conducted.

Supplemental Guidance: As part of the risk framing step in the risk management process, organizations make explicit
the specific assumptions, constraints, risk tolerance, and priorities/trade-offs used within organizations to make
investment and operational decisions. This information guides and informs organizational risk assessments. When an
organizational risk management strategy cannot be cited, risk assessments identify and document assumptions and
constraints. Assumptions and constraints identified by organizations during the risk framing step and included as part
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 1-4: Identify the sources of descriptive, threat, vulnerability, and impact information to be used in the

TASK 1-4: Identify the sources of descriptive, threat, vulnerability, and impact information to be used in the

risk assessment.
Supplemental Guidance: Descriptive information enables organizations to be able to determine the relevance of threat
and vulnerability information. At Tier 1, descriptive information can include, for example, the type of risk management
and information security governance structures in place within organizations and how the organization identifies and
prioritizes critical missions/business functions. At Tier 2, descriptive information can include, for example, information
about: (i) organizational mission/business processes, functional management processes, and information flows; (ii)
enterprise architecture, information security architecture, and the technical/process flow architectures of the systems,
common infrastructures, and shared services that fall within the scope of the risk assessment; and (iii) the external
environments in which organizations operate including, for example, the relationships and dependencies with external
providers. Such information is typically found in architectural documentation (particularly documentation of high-level
operational views), business continuity plans, and risk assessment reports for organizational information systems,
common infrastructures, and shared services that fall within the scope of the risk assessment. At Tier 3, descriptive
information can include, for example, information about: (i) the design of and technologies used in organizational
information systems; (ii) the environment in which the systems operate; (iii) connectivity to and dependency on other
information systems; and (iv) dependencies on common infrastructures or shared services. Such information is found in
system documentation, contingency plans, and risk assessment reports for other information systems, infrastructures,
and services.
Sources of information as described in Tables D-1, E-1, F-1, H-1, and I-1 can be either internal or external to
organizations. Internal sources of information that can provide insights into both threats and vulnerabilities can include,
for example, risk assessment reports, incident reports, security logs, trouble tickets, and monitoring results. Note that
internally, information from risk assessment reports at one tier can serve as input to risk assessments at other tiers.
Mission/business owners are encouraged to identify not only common infrastructure and/or support services they
depend on, but also those they might use under specific operational circumstances. External sources of threat
information can include cross-community organizations (e.g., US Computer Emergency Readiness Team [US-CERT],
sector partners (e.g., Defense Industrial Base [DIB] using the DoD-Defense Industrial Base Collaborative Information
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 1-5: Identify the risk model and analytic approach to be used in the risk assessment.

TASK 1-5: Identify the risk model and analytic approach to be used in the risk assessment.

Supplemental Guidance: Organizations define one or more risk models for use in conducting risk assessments (see
Guide for Conducting Risk Assessments
CHAPTER 3 > Task 2-1 and the threat events identified in Task 2-2 that can be initiated by those threat sources. Vulnerabilities at Tier

Task 2-1 and the threat events identified in Task 2-2 that can be initiated by those threat sources. Vulnerabilities at Tier

1 can be pervasive across organizations and can have wide-ranging adverse impacts if exploited by threat events. For
example, organizational failure to consider supply chain activities can result in organizations acquiring subverted
components that adversaries could exploit to disrupt organizational missions/business functions or to obtain sensitive
organizational information. Vulnerabilities at Tier 2 can be described in terms of organizational mission/business
processes, enterprise architecture, the use of multiple information systems, or common infrastructures/shared services.
At Tier 2, vulnerabilities typically cross or span information system boundaries. Vulnerabilities at Tier 3 can be
described in terms of the information technologies employed within organizational information systems, the
environments in which those systems operate, and/or the lack of or weaknesses in system-specific security controls.
There is potentially a many-to-many relationship between threat events and vulnerabilities. Multiple threat events can
exploit a single vulnerability, and conversely, multiple vulnerabilities can be exploited by a single threat event. The
severity of a vulnerability is an assessment of the relative importance of mitigating such a vulnerability. Initially, the
extent to which mitigation is unplanned can serve as a surrogate for vulnerability severity. Once the risks associated
with a particular vulnerability have been assessed, the impact severity and exposure of the vulnerability given the
security controls implemented and other vulnerabilities can be taken into consideration in assessing vulnerability
severity. Assessments of vulnerability severity support risk response. Vulnerabilities can be identified at varying
degrees of granularity and specificity. The level of detail provided in any particular vulnerability assessment is
consistent with the purpose of the risk assessment and the type of inputs needed to support follow-on likelihood and
impact determinations.
Due to the ever-increasing size and complexity of organizations, mission/business processes, and the information
systems supporting those processes, the number of vulnerabilities tends to be large and can increase the overall
complexity of the analysis. Therefore, organizations have the option of using the vulnerability identification task to
understand the general nature of the vulnerabilities (including scope, number, and type) relevant to the assessment (see
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 2-1: Identify and characterize threat sources of concern, including capability, intent, and targeting

STEP 2: CONDUCT THE ASSESSMENT

IDENTIFY THREAT SOURCES

TASK 2-1: Identify and characterize threat sources of concern, including capability, intent, and targeting

characteristics for adversarial threats and range of effects for non-adversarial threats.
Supplemental Guidance: Organizations identify threat sources of concern and determine the characteristics associated
with those threat sources. For adversarial threat sources, assess the capabilities, intentions, and targeting associated
with the threat sources. For non-adversarial threat sources, assess the potential range of effects from the threat sources.
The risk management strategy and the results of the Prepare step provide organizational direction and guidance for
conducting threat source identification and characterization including, for example: (i) sources for obtaining threat
information; (ii) threat sources to consider (by type/name); (iii) threat taxonomy to be used; and (iv) the process for
identifying which threat sources are of concern for the risk assessment. As identified in Task 1-3, organizations make
explicit any assumptions concerning threat sources including decisions regarding the identification of threat sources
when specific and credible threat information is unavailable. Organizations can also view adversarial threat sources
from a broad-based perspective, considering the time such threat sources may have to exploit identified organizational
vulnerabilities, the scale of the attack, and the potential use of multiple attack vectors. The identification and
characterization of Advanced Persistent Threats (APTs) can involve considerable uncertainty. Organizations annotate
such threat sources with appropriate rationale and references (and providing classifications as necessary).
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 2-2: Identify potential threat events, relevance of the events, and the threat sources that could initiate

TASK 2-2: Identify potential threat events, relevance of the events, and the threat sources that could initiate

the events.
Supplemental Guidance: Threat events are characterized by the threat sources that could initiate the events, and for
adversarial events, the TTPs used to carry out attacks. Organizations define these threat events with sufficient detail to
accomplish the purpose of the risk assessment. At Tier 1, threat events that could affect the organizational level are of
particular interest. At Tier 2, threat events that cross or span information system boundaries, exploit functional
dependencies or connectivity among systems, or affect mission/business owners, are of particular interest. At Tier 3,
threat events that can be described in terms of specific information systems, technologies, or environments of operation
are of particular interest. Multiple threat sources can initiate a single threat event. Conversely, a single threat source can
potentially initiate any of multiple threat events. Therefore, there can be a many-to-many relationship among threat
events and threat sources that can potentially increase the complexity of the risk assessment. To enable effective use
and communication of risk assessment results, organizations tailor the general descriptions of threat events in Tables E-
2 and E-3 to identify how each event could potentially harm organizational operations (including mission, functions,
image, or reputation) and assets, individuals, other organizations, or the Nation. For each threat event identified,
organizations determine the relevance of the event. Table E-4 provides a range of values for relevance of threat events.
The values selected by organizations have a direct linkage to organizational risk tolerance. The more risk averse, the
greater the range of values considered. Organizations accepting greater risk or having a greater risk tolerance are more
likely to require substantive evidence before giving serious consideration to threat events. If a threat event is deemed to
be irrelevant, no further consideration is given. For relevant threat events, organizations identify all potential threat
sources that could initiate the events. For use in Task 2-4, organizations can identify each pairing of threat source and
threat event separately since the likelihood of threat initiation and success could be different for each pairing.
Alternatively, organizations can identify the set of all possible threat sources that could potentially initiate a threat
event.
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 2-3: Identify vulnerabilities and predisposing conditions that affect the likelihood that threat events of

CHAPTER 3

IDENTIFY VULNERABILITIES AND PREDISPOSING CONDITIONS

TASK 2-3: Identify vulnerabilities and predisposing conditions that affect the likelihood that threat events of

concern result in adverse impacts.
Supplemental Guidance: The primary purpose of vulnerability assessments is to understand the nature and degree to
which organizations, mission/business processes, and information systems are vulnerable to threat sources identified in
Guide for Conducting Risk Assessments
Section 2.3.1) and identify which model is to be used for the risk assessment. To facilitate reciprocity of assessment > Task 2-4 for examples). Organization-specific risk models are refined as part of preparation for a risk assessment by: (i)

Task 2-4 for examples). Organization-specific risk models are refined as part of preparation for a risk assessment by: (i)

identifying the risk model and the rationale for using it (when multiple organization-specific risk models are provided);
(ii) providing additional examples for values of risk factors; and (iii) identifying any assessment-specific algorithms
(e.g., algorithms specific to the use of an attack graph analysis technique). In the absence of pre-existing organization-
specific risk models or analytic approaches defined in the organizational risk management strategy, the risk model and
analytic approaches to be used in the risk assessment are defined and documented in this task.
Summary of Key Activities - Preparing for Risk Assessments
•
Identify the purpose of the risk assessment.
•
Identify the scope of the risk assessment.
•
Identify the assumptions and constraints under which the risk assessment is conducted.
•
Identify sources of threat, vulnerability, and impact information to be used in the risk
assessment (see Tables D-1, E-1, F-1, H-1, and I-1 as tailored by the organization).
•
Define or refine the risk model, assessment approach, and analysis approach to be used in
the risk assessment.
Guide for Conducting Risk Assessments
Appendix G provides a set of exemplary tables for use in determining likelihood of threat events: > TASK 2-5: Determine the adverse impacts from threat events of concern considering: (i) the characteristics of

TASK 2-5: Determine the adverse impacts from threat events of concern considering: (i) the characteristics of

the threat sources that could initiate the events; (ii) the vulnerabilities/predisposing conditions identified;
and (iii) the susceptibility reflecting the safeguards/countermeasures planned or implemented to impede
such events.
Supplemental Guidance: Organizations describe adverse impacts in terms of the potential harm caused to organizational
operations and assets, individuals, other organizations, or the Nation. Where the threat event occurs and whether the
effects of the event are contained or spread, influences the severity of the impact. Assessing impact can involve
identifying assets or potential targets of threat sources, including information resources (e.g., information, data
Summary of Key Activities - Task 2-4
•
Identify likelihood determination inputs (see Table G-1, as tailored by the organization).
•
Identify likelihood determination factors using organization-defined information sources
(e.g., threat source characteristics, vulnerabilities, predisposing conditions).
•
Assess the likelihood of threat event initiation for adversarial threats and the likelihood of
threat event occurrence for non-adversarial threats (see Table G-2 and Table G-3, as tailored
by the organization).
•
Assess the likelihood of threat events resulting in adverse impacts, given likelihood of
initiation or occurrence (see Table G-4, as tailored by the organization).
•
Assess the overall likelihood of threat event initiation/occurrence and likelihood of threat
events resulting in adverse impacts (see Table G-5, as tailored by the organization).
•
Update Columns 7, 10, and 11 in Table I-5 for adversarial risk (see Table G-2, Table G-4, and
Table G-5); or update Columns 5, 8, and 9 in Table I-7 for non-adversarial risk (see Table G-3,
Table G-4, and Table G-5).
Guide for Conducting Risk Assessments
Appendix H provides a set of exemplary tables for use in determining adverse impacts: > TASK 2-6: Determine the risk to the organization from threat events of concern considering: (i) the impact

TASK 2-6: Determine the risk to the organization from threat events of concern considering: (i) the impact

that would result from the events; and (ii) the likelihood of the events occurring.
Supplemental Guidance: Organizations assess the risks from threat events as a combination of likelihood and impact.
The level of risk associated with identified threat events represents a determination of the degree to which
organizations are threatened by such events. Organizations make explicit the uncertainty in the risk determinations,
including, for example, organizational assumptions and subjective judgments/decisions. Organizations can order the list
of threat events of concern by the level of risk determined during the risk assessment-with the greatest attention going
to high-risk events. Organizations can further prioritize risks at the same level or with similar scores (see Appendix J).
Each risk corresponds to a specific threat event with a level of impact if that event occurs. In general, the risk level is
typically not higher than the impact level, and likelihood can serve to reduce risk below that impact level. However,
when addressing organization-wide risk management issues with a large number of missions/business functions,
mission/business processes, and supporting information systems, impact as an upper bound on risk may not hold. For
example, when multiple risks materialize, even if each risk is at the moderate level, the set of those moderate-level risks
could aggregate to a higher level of risk for organizations. To address situations where harm occurs multiple times,
organizations can define a threat event as multiple occurrences of harm and an impact level associated with the
cumulative degree of harm. During the execution of Tasks 2-1 through 2-5, organizations capture key information
related to uncertainties in risk assessments. These uncertainties arise from sources such as missing information,
subjective determinations, and assumptions made. The effectiveness of risk assessment results is in part determined by
the ability of decision makers to be able to determine the continued applicability of assumptions made as part of the
assessment. Information related to uncertainty is compiled and presented in a manner that readily supports informed
risk management decisions.
Guide for Conducting Risk Assessments
CHAPTER 3 > 3.3 COMMUNICATING AND SHARING RISK ASSESSMENT INFORMATION > TASK 3-1: Communicate risk assessment results to organizational decision makers to support risk responses.

STEP 3: COMMUNICATE AND SHARE RISK ASSESSMENT RESULTS

COMMUNICATE RISK ASSESSMENT RESULTS

TASK 3-1: Communicate risk assessment results to organizational decision makers to support risk responses.

Supplemental Guidance: Organizations can communicate risk assessment results in a variety of ways (e.g., executive
briefings, risk assessment reports, dashboards). Such risk communications can be formal or informal with the content
and format determined by organizations initiating and conducting the assessments. Organizations provide guidance on
specific risk communication and reporting requirements, included as part of preparing for the risk assessment (if not
provided in the risk management strategy as part of the risk framing task). Organizations prioritize risks at the same
level or with similar scores (see Appendix J). Appendix K provides an example of type of information that may be
included in a risk assessment report or the preferred vehicle for risk communication.
SHARE RISK-RELATED INFORMATION
Guide for Conducting Risk Assessments
CHAPTER 3 > 3.3 COMMUNICATING AND SHARING RISK ASSESSMENT INFORMATION > TASK 3-2: Share risk-related information produced during the risk assessment with appropriate

TASK 3-2: Share risk-related information produced during the risk assessment with appropriate

organizational personnel.
Supplemental Guidance: Organizations share source information and intermediate results and provide guidance on
sharing risk-related information. Information sharing occurs primarily within organizations, via reports and briefings,
and by updating risk-related data repositories with supporting evidence for the risk assessment results. Information
sharing is also supported by documenting the sources of information, analytical processes, and intermediate results
(e.g., the completed tables in Appendices D-I), so that risk assessments can be easily maintained. Information sharing
may also occur with other organizations.
47 The risk assessment process entails ongoing communications and information sharing between those personnel
performing assessment activities, subject matter experts, and key organizational stakeholders (e.g., mission/business
owners, risk executive [function], chief information security officers, information system owners/program managers).
This communication and information sharing ensures that: (i) the inputs to risk assessments are as accurate as possible;
(ii) intermediate results can be used (e.g., to support risk assessments at other tiers); and (iii) results are meaningful and
useful inputs to risk response.
Summary of Key Activities - Communicating and Sharing Information
•
Determine the appropriate method (e.g., executive briefing, risk assessment report, or
dashboard) to communicate risk assessment results.
•
Communicate risk assessment results to designated organizational stakeholders.
•
Share the risk assessment results and supporting evidence in accordance with organizational
policies and guidance.
Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 4-2: Update existing risk assessment using the results from ongoing monitoring of risk factors.

TASK 4-2: Update existing risk assessment using the results from ongoing monitoring of risk factors.

Supplemental Guidance: Organizations determine the frequency and the circumstances under which risk assessments
are updated. Such determinations can include, for example, the current level of risk to and/or the importance of, core
organizational missions/business functions. If significant changes (as defined by organizational policies, direction, or
guidance) have occurred since the risk assessment was conducted, organizations can revisit the purpose, scope,
assumptions, and constraints of the assessment to determine whether all tasks in the risk assessment process need to be
repeated. Otherwise, the updates constitute subsequent risk assessments, identifying and assessing only how selected
risk factors have changed, for example: (i) the identification of new threat events, vulnerabilities, predisposing
conditions, undesirable consequences and/or affected assets; and (ii) the assessments of threat source characteristics
(e.g., capability, intent, targeting, range of effects), likelihoods, and impacts. Organizations communicate the results of
subsequent risk assessments to entities across all risk management tiers to ensure that responsible organizational
officials have access to critical information needed to make ongoing risk-based decisions.
Summary of Key Activities - Maintaining Risk Assessments
•
Identify key risk factors that have been identified for ongoing monitoring.
•
Identify the frequency of risk factor monitoring activities and the circumstances under which
the risk assessment needs to be updated.
•
Reconfirm the purpose, scope, and assumptions of the risk assessment.
•
Conduct the appropriate risk assessment tasks, as needed.
•
Communicate the subsequent risk assessment results to specified organizational personnel.
Guide for Conducting Risk Assessments
CHAPTER TWO > THE FUNDAMENTALS

THE FUNDAMENTALS

BASIC CONCEPTS ASSOCIATED WITH RISK ASSESSMENTS
his chapter describes the fundamental concepts associated with assessing information
security risk within an organization including: (i) a high-level overview of the risk
management process and the role risk assessments play in that process; (ii) the basic
concepts used in conducting risk assessments; and (iii) how risk assessments can be applied
across the organization's risk management tiers.12