Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > THE PROCESS

THE PROCESS

APPLYING RISK MANAGEMENT CONCEPTS ACROSS AN ORGANIZATION
T
his chapter describes a process for managing information security risk including: (i) a
general overview of the risk management process; (ii) how organizations establish the
context for risk-based decisions; (iii) how organizations assess risk considering threats,
vulnerabilities, likelihood, and consequences/impact; (iv) how organizations respond to risk once
determined; and (v) how organizations monitor risk over time with changing mission/business
needs, operating environments, and supporting information systems . The risk management
process, introduced in Chapter Two, is described in this chapter along with its applicability across
the three tiers of risk management. Each of the steps in the risk management process (i.e., risk
framing, risk assessment, risk response, and risk monitoring) is described in a structured manner
focusing on the inputs or preconditions necessary to initiate the step, the specific activities that
compose the step, and the outputs or post conditions resulting from the step.60 The effect of the
risk concepts described in Chapter Two (e.g., risk tolerance, trust, and culture) are also discussed
in the context of the risk management process and its multitiered application. Figure 4 illustrates
the risk management process as applied across the tiers-organization, mission/business process,
and information system. The bidirectional arrows in the figure indicate that the information and
communication flows among the risk management components as well as the execution order of
the components, may be flexible and respond to the dynamic nature of the risk management
process as it is applied across all three tiers.
TIER 3 - INFORMATION SYSTEMS
TIER 2 - MISSION / BUSINESS PROCESSES
TIER 1 - ORGANIZATION
FRAME
ASSESS
RESPOND
MONITOR
FIGURE 4: RISK MANAGEMENT PROCESS APPLIED ACROSS THE TIERS
60 Additional guidance on selected steps in the risk management process (e.g., risk assessment, risk monitoring) can be
found in other NIST Special Publications listed in Appendix A.
The steps in the risk management process are not inherently sequential in nature. The steps are
performed in different ways, depending on the particular tier where the step is applied and on
prior activities related to each of the steps. What is consistent is that the outputs or post conditions
from a particular risk management step directly impact one or more of the other risk management
steps in the risk management process. Organizations have significant flexibility in how the risk
management steps are performed (e.g., sequence, degree of rigor, formality, and thoroughness of
application) and in how the results of each step are captured and shared-both internally and
externally. Ultimately, the objective of applying the risk management process and associated risk-
related concepts is to develop a better understanding of information security risk in the context of
the broader actions and decisions of organizations and in particular, with respect to organizational
operations and assets, individuals, other organizations, and Nation.