ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS > 2.8.2 Trust and Culture

2.8.2 Trust and Culture

There is also potential interplay between the concepts of risk, trust, and culture. Changes in
mission/business requirements (e.g., a new mission or business requirement to interconnect
information systems for the purpose of sharing information) may require a greater acceptance of
risk than is typical for that organization. In the short term, additional measures may be needed to
establish and/or build trust (e.g., increase transparency between interconnecting organizations).
Such measures facilitate building trust and evolving organizational beliefs and norms over the
longer term. Interaction between trust and culture can also be observed when there are gaps and
overlaps in responsibility among an organization's components that may impact the ability for
proposed actions (especially new actions) to be carried out quickly. For example, many
organizations with decentralized governance structures may be slower to embrace change unless
there has been an extensive effort to expand coordination and improve trust among organizational
components. Assume that some organizations are directed by higher authorities (see mandated
trust model in Appendix G) to share information more freely with peer organizations. If the
organizations have a history and culture of tightly controlling information, they may be reluctance
to share information with outside entities, even though directed to do so. In such situations,
organizations may require that partnering organizations provide concrete evidence of the steps
taken to protect the information designated for sharing prior to release.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS > 2.8.3 Investment Strategy and Risk Tolerance

2.8.3 Investment Strategy and Risk Tolerance

Investment strategies and organizational risk tolerance also have linkages. Organizations may
recognize that there is a need to address advanced persistent threats where adversaries have
achieved some degree of penetration of and foothold within organizational information systems
and the environments in which those systems operate. The strategic investments that are required
to address these types of threats may, in part, be influenced by the risk tolerance of organizations.
Less risk-tolerant organizations may focus investments on information technologies that prevent
adversaries from gaining further access within organizations and/or limiting the damage done to
the organizations even if at the expense of achieving some of the many mission/business benefits
automation can provide. More risk-tolerant organizations may focus investments on information
technologies that provide greater mission/business benefits even if these benefits are achieved at
the expense of adversaries gaining some advantage or benefit from compromising the information
systems and supporting infrastructure.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS > 2.8.4 Culture and Risk Tolerance

2.8.4 Culture and Risk Tolerance

A major part of managing risk within organizations is identifying what the organizational risk
tolerance is for a particular type of loss. Risk tolerance can be described as a combination of the
cultural willingness to accept certain types of loss within organizations and the subjective risk-
related actions of senior leaders/executives. Risk-based decisions within organizations often
reflect the blending of the risk tolerance of senior leaders/executives and the risk tolerance that is
embedded within the culture of organizations. In establishing organizational risk tolerance, the
values, beliefs, and norms of organizations are examined in order to understand why risk trade-
offs are made. For some organizations, in particular those organizations that deal with critical
and/or sensitive information, personally identifiable information, or classified information, the
emphasis is often on preventing unauthorized disclosure. In contrast, in those organizations
driven by a combination of organizational culture and the nature of their missions and business
functions, the emphasis is on maintaining the availability of information systems to achieve an
ongoing operational capability. As part of establishing organizational risk tolerance, a risk
assessment identifies the kinds and levels of risk to which organizations may be exposed. This
assessment considers both the likelihood and impact of undesired events (see Chapter Three, the
risk management process).
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK

3.1 FRAMING RISK

Risk framing establishes the context and provides a common perspective on how organizations
manage risk. Risk framing, as its principal output, produces a risk management strategy that
addresses how organizations intend to assess risk, respond to risk, and monitor risk. The risk
management strategy makes explicit the specific assumptions, constraints, risk tolerances, and
priorities/trade-offs used within organizations for making investment and operational decisions.
The risk management strategy also includes any strategic-level decisions and considerations on
how risk to organizational operations and assets, individuals, other organizations, and the Nation,
is to be managed by senior leaders/executives.
At Tier 1, senior leaders/executives, in consultation and collaboration with the risk executive
(function), define the organizational risk frame including the types of risk decisions (e.g., risk
responses) supported, how and under what conditions risk is assessed to support those risk
decisions, and how risk is monitored (e.g., to what level of detail, in what form, and with what
frequency). At Tier 2, mission/business owners apply their understanding of the organizational
risk frame to address concerns specific to the organization's missions/business functions (e.g.,
additional assumptions, constraints, priorities, and trade-offs). At Tier 3, program managers,
information system owners, and common control providers apply their understanding of the
organizational risk frame based on how decision makers at Tiers 1 and 2 choose to manage risk.
The Risk Management Framework61 is the primary means for addressing risk at Tier 3. The RMF
addresses concerns specific to the design, development, implementation, operation, and disposal
of organizational information systems and the environments in which those systems operate. The
risk frame can be adapted at Tier 3 based on the current phase of the system development life
cycle, which further constrains potential risk responses. Initially, organizational risk frames might
not be explicit or might not be defined in terms that correspond to the risk management tiers. In
the absence of explicit risk frames (describing assumptions, constraints, risk tolerance, and
priorities/trade-offs), mission/business owners can have divergent perspectives on risk or how to
manage it. This impedes a common understanding at Tier 1 of how information security risk
contributes to organizational risk, and at Tier 2, of how risk accepted for one mission or business
function potentially affects risk with respect to other missions/business functions. Differences in
risk tolerance and the underlying assumptions, constraints, and priorities/trade-offs are grounded
in operational and/or architectural considerations and should be understood and accepted by
senior leaders/executives within their respective organizations.
61 The Risk Management Framework (RMF) which operates primarily at Tier 3 is described in NIST Special
Publication 800-37.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.3 RESPONDING TO RISK

3.3 RESPONDING TO RISK

Risk response identifies, evaluates, decides on, and implements appropriate courses of action to
accept, avoid, mitigate, share, or transfer risk to organizational operations and assets, individuals,
other organizations, and the Nation, resulting from the operation and use of information systems.
Identifying and analyzing alternative courses of action63 typically occurs at Tier 1 or Tier 2. This
is due to the fact that alternative courses of action (i.e., potential risk responses) are evaluated in
terms of anticipated organization-wide impacts and the ability of organizations to continue to
successfully carry out organizational missions and business functions. Decisions to employ risk
response measures organization-wide are typically made at Tier 1, although the decisions are
informed by risk-related information from the lower tiers. At Tier 2, alternative courses of action
are evaluated in terms of anticipated impacts on organizational missions/business functions, the
associated mission/business processes supporting the missions/business functions, and resource
requirements. At Tier 3, alternative courses of action tend to be evaluated in terms of the system
development life cycle or the maximum amount of time available for implementing the selected
course(s) of action. The breadth of potential risk responses is a major factor for whether the
activity is carried out at Tier 1, Tier 2, or Tier 3. Risk decisions are influenced by organizational
risk tolerance developed as part of risk framing activities at Tier 1. Organizations can implement
risk decisions at any of the risk management tiers with different objectives and utility of
information produced.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > 3.4 MONITORING RISK

3.4 MONITORING RISK

Risk monitoring provides organizations with the means to: (i) verify compliance;64 (ii) determine
the ongoing effectiveness of risk response measures; and (iii) identify risk-impacting changes to
organizational information systems and environments of operation. Analyzing monitoring results
gives organizations the capability to maintain awareness of the risk being incurred, highlight the
need to revisit other steps in the risk management process, and initiate process improvement
activities as needed.65 Organizations employ risk monitoring tools, techniques, and procedures to
increase risk awareness, helping senior leaders/executives develop a better understanding of the
ongoing risk to organizational operations and assets, individuals, other organizations, and the
Nation. Organizations can implement risk monitoring at any of the risk management tiers with
different objectives and utility of information produced. For example, Tier 1 monitoring activities
might include ongoing threat assessments and how changes in the threat space may affect Tier 2
and Tier 3 activities, including enterprise architectures (with embedded information security
architectures) and organizational information systems. Tier 2 monitoring activities might include,
for example, analyses of new or current technologies either in use or considered for future use by
organizations to identify exploitable weaknesses and/or deficiencies in those technologies that
may affect mission/business success. Tier 3 monitoring activities focus on information systems
and might include, for example, automated monitoring of standard configuration settings for
information technology products, vulnerability scanning, and ongoing assessments of security
controls. In addition to deciding on appropriate monitoring activities across the risk management
tiers, organizations also decide how monitoring is to be conducted (e.g., automated or manual
approaches) and the frequency of monitoring activities based on, for example, the frequency with
which deployed security controls change, critical items on plans of action and milestones, and
risk tolerance.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX A

7.
Guide for Mapping Types of Information and Information Systems to Security Categories,
August 2008.
8.
National Checklist Program for IT Products--Guidelines for Checklist Users and
Developers, September 2009.
9.
Public Draft, Information Security Continuous Monitoring for Federal Information
Systems and Organizations, December 2010.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Authenticity
Authorization
(to operate)
Authorization Boundary
[NIST SP 800-37]
Authorizing Official
[CNSSI 4009]
Availability
[44 U.S.C., Sec. 3542]
Chief Information Officer
[PL 104-106, Sec. 5125(b)]
Chief Information Security Officer
Classified National Security
Information
[CNSSI 4009]
The property of being genuine and being able to be
verified and trusted; confidence in the validity of a
transmission, a message, or message originator. See
Authentication.
The official management decision given by a senior
organizational official to authorize operation of an
information system and to explicitly accept the risk to
organizational operations (including mission, functions,
image, or reputation), organizational assets, individuals,
other organizations, and the Nation based on the
implementation of an agreed-upon set of security
controls.
All components of an information system to be
authorized for operation by an authorizing official and
excludes separately authorized systems, to which the
information system is connected.
Senior (federal) official or executive with the authority to
formally assume responsibility for operating an
information system at an acceptable level of risk to
organizational operations (including mission, functions,
image, or reputation), organizational assets, individuals,
other organizations, and the Nation.
Ensuring timely and reliable access to and use of
information.
Agency official responsible for:
(i) Providing advice and other assistance to the head of
the executive agency and other senior management
personnel of the agency to ensure that information
technology is acquired and information resources are
managed in a manner that is consistent with laws,
Executive Orders, directives, policies, regulations, and
priorities established by the head of the agency;
(ii) Developing, maintaining, and facilitating the
implementation of a sound and integrated information
technology architecture for the agency; and
(iii) Promoting the effective and efficient design and
operation of all major information resources management
processes for the agency, including improvements to
work processes of the agency.
See Senior Agency Information Security Officer.
Information that has been determined pursuant to Executive
Order 13526 or any predecessor order to require protection
against unauthorized disclosure and is marked to indicate its
classified status when in documentary form.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Technical Controls
[FIPS 200]
Threat
[CNSSI 4009]
Threat Assessment
[CNSSI 4009]
Threat Source
[CNSSI 4009]
Trustworthiness
[CNSSI 4009]
Vulnerability
[CNSSI 4009]
Vulnerability Assessment
[CNSSI 4009]
Security controls (i.e., safeguards or countermeasures) for
an information system that are primarily implemented
and executed by the information system through
mechanisms contained in the hardware, software, or
firmware components of the system.
Any circumstance or event with the potential to adversely
impact organizational operations (including mission,
functions, image, or reputation), organizational assets,
individuals, other organizations, or the Nation through an
information system via unauthorized access, destruction,
disclosure, modification of information, and/or denial of
service.
Process of formally evaluating the degree of threat to an
information system or enterprise and describing the
nature of the threat.
The intent and method targeted at the intentional
exploitation of a vulnerability or a situation and method
that may accidentally exploit a vulnerability.
The attribute of a person or enterprise that provides
confidence to others of the qualifications, capabilities,
and reliability of that entity to perform specific tasks and
fulfill assigned responsibilities.
Weakness in an information system, system security
procedures, internal controls, or implementation that
could be exploited by a threat source.
Systematic examination of an information system or
product to determine the adequacy of security measures,
identify security deficiencies, provide data from which to
predict the effectiveness of proposed security measures,
and confirm the adequacy of such measures after
implementation.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Common Control
[NIST SP 800-37]
Common Control Provider
[NIST SP 800-37]
Compensating Security Control
[CNSSI 4009]
Confidentiality
[44 U.S.C., Sec. 3542]
Course of Action (Risk Response)
Cyber Attack
[CNSSI 4009]
Cyber Security
[CNSSI 4009]
Cyberspace
[CNSSI 4009]
Defense-in-Breadth
[CNSSI 4009]
Defense-in-Depth
[CNSSI 4009]
A security control that is inherited by one or more
organizational information systems. See Security Control
Inheritance.
An organizational official responsible for the
development, implementation, assessment, and
monitoring of common controls (i.e., security controls
inherited by information systems).
A management, operational, and/or technical control (i.e.,
safeguard or countermeasure) employed by an
organization in lieu of a recommended security control in
the low, moderate, or high baselines that provides
equivalent or comparable protection for an information
system.
Preserving authorized restrictions on information access
and disclosure, including means for protecting personal
privacy and proprietary information.
A time-phased or situation-dependent combination of risk
response measures.
An attack, via cyberspace, targeting an enterprise's use of
cyberspace for the purpose of disrupting, disabling,
destroying, or maliciously controlling a computing
environment/infrastructure; or destroying the integrity of
the data or stealing controlled information.
The ability to protect or defend the use of cyberspace
from cyber attacks.
A global domain within the information environment
consisting of the interdependent network of information
systems infrastructures including the Internet,
telecommunications networks, computer systems, and
embedded processors and controllers.
A planned, systematic set of multidisciplinary activities
that seek to identify, manage, and reduce risk of
exploitable vulnerabilities at every stage of the system,
network, or subcomponent life cycle (system, network, or
product design and development; manufacturing;
packaging; assembly; system integration; distribution;
operations; maintenance; and retirement).
Information security strategy integrating people,
technology, and operations capabilities to establish
variable barriers across multiple layers and missions of
the organization.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Enterprise
[CNSSI 4009]
Enterprise Architecture
[CNSSI 4009]
Environment of Operation
[NIST SP 800-37]
Executive Agency
[41 U.S.C., Sec. 403]
Federal Agency
Federal Information
System
[40 U.S.C., Sec. 11331]
Hybrid Security Control
[NIST SP 800-53]
Individuals
Industrial Control System
Information
[CNSSI 4009]
[FIPS 199]
An organization with a defined mission/goal and a
defined boundary, using information systems to execute
that mission, and with responsibility for managing its
own risks and performance. An enterprise may consist of
all or some of the following business aspects: acquisition,
program management, financial management (e.g.,
budgets), human resources, security, and information
systems, information and mission management. See
Organization.
The description of an enterprise's entire set of
information systems: how they are configured, how they
are integrated, how they interface to the external
environment at the enterprise's boundary, how they are
operated to support the enterprise mission, and how they
contribute to the enterprise's overall security posture.
The physical surroundings in which an information
system processes, stores, and transmits information.
An executive department specified in 5 U.S.C., Sec. 101;
a military department specified in 5 U.S.C., Sec. 102; an
independent establishment as defined in 5 U.S.C., Sec.
104(1); and a wholly owned Government corporation
fully subject to the provisions of 31 U.S.C., Chapter 91.
See Executive Agency.
An information system used or operated by an executive
agency, by a contractor of an executive agency, or by
another organization on behalf of an executive agency.
A security control that is implemented in an information
system in part as a common control and in part as a
system-specific control. See Common Control and
System-Specific Security Control.
An assessment object that includes people applying
specifications, mechanisms, or activities.
An information system used to control industrial
processes such as manufacturing, product handling,
production, and distribution. Industrial control systems
include supervisory control and data acquisition systems
used to control geographically dispersed assets, as well as
distributed control systems and smaller control systems
using programmable logic controllers to control localized
processes.
Any communication or representation of knowledge such
as facts, data, or opinions in any medium or form,
including textual, numerical, graphic, cartographic,
narrative, or audiovisual.
An instance of an information type.