Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK > STEP 1: RISK FRAMING

STEP 1: RISK FRAMING

Inputs and Preconditions
Risk framing is the set of assumptions, constraints, risk tolerances, and priorities/trade-offs that shape an organization's
approach for managing risk. Risk framing is informed by the organizational governance structure, financial posture,
legal/regulatory environment, investment strategy, culture, and trust relationships established within and among
organizations. Inputs to the risk framing step include, for example, laws, policies, directives, regulations, contractual
relationships, and financial limitations which impose constraints on potential risk decisions by organizations. Other
inputs to risk framing can include, for example, specific information from organizations to make explicit: (i) the
identification of trust relationships and trust models (see Appendix G) that derive from existing memoranda of
understanding or agreement (MOUs or MOAs); and (ii) the identification of the governance structures and processes
that indicate the extent of or limits on decision-making authority for risk decisions that can be delegated to mission or
business owners. The key precondition for risk framing is senior leadership commitment to defining an explicit risk
management strategy and holding mission/business owners responsible and accountable for implementing the strategy.
The guidance produced by the risk framing step, and the underlying assumptions, constraints, risk tolerances, and
priorities/trade-offs used to develop that guidance, may be inappropriate to one or more organizational missions or
business functions. In addition, the risk environment has the potential to change over time. Thus, the risk management
process allows for feedback to the risk framing step from the other steps in the process, as follows:
•
Risk assessment: Information generated during the risk assessment may influence the original assumptions, change
the constraints regarding appropriate risk responses, identify additional tradeoffs, or shift priorities. For example,
the characterization of adversaries (including representative tactics, techniques, and procedures), or sources of
vulnerability information may not be consistent with how some organizations conduct their missions/business
functions; a source of threat/vulnerability information that is useful for one mission/business function could, in
fact, be useful for others; or organizational guidance on assessing risk under uncertainty may be too onerous, or
insufficiently defined, to be useful for one or more mission/business functions.
•
Risk response: Information uncovered during the development of alternative courses of action could reveal that
risk framing has removed or failed to uncover some potentially high-payoff alternatives from consideration. This
situation may challenge organizations to revisit original assumptions or investigate ways to change established
constraints.
•
Risk monitoring: Security control monitoring by organizations could indicate that a class of controls, or a specific
implementation of a control, is relatively ineffective, given investments in people, processes, or technology. This
situation could lead to changes in assumptions about which types of risk responses are preferred by organizations.
Monitoring of the operational environment could reveal changes in the threat landscape (e.g., changes in the
tactics, techniques, and procedures observed across all organizational information systems; increasing frequency
and/or intensity of attacks against specific missions/business functions) that cause organizations to revisit original
threat assumptions and/or to seek different sources of threat information. Significant advances in defensive or
proactive operational and technical solutions could generate the need to revisit the investment strategy identified
during the framing step. Monitoring of legal/regulatory environments could also influence changes in assumptions
or constraints. Also, monitoring of risk being incurred might result in the need to reconsider the organizational risk
tolerance if the existing statement of risk tolerance does not appear to match the operational realities.
Activities
RISK ASSUMPTIONS