Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER ONE > INTRODUCTION

INTRODUCTION

THE NEED FOR INTEGRATED ORGANIZATION-WIDE RISK MANAGEMENT
nformation technology is widely recognized as the engine that drives the U.S. economy,
giving industry a competitive advantage in global markets, enabling the federal government
to provide better services to its citizens, and facilitating greater productivity as a nation.
Organizations5 in the public and private sectors depend on technology-intensive information
systems6 to successfully carry out their missions and business functions. Information systems can
include diverse entities ranging from high-end supercomputers, workstations, personal computers,
cellular telephones, and personal digital assistants to very specialized systems (e.g., weapons
systems, telecommunications systems, industrial/process control systems, and environmental
control systems). Information systems are subject to serious threats that can have adverse effects
on organizational operations (i.e., missions, functions, image, or reputation), organizational
assets, individuals, other organizations, and the Nation by exploiting both known and unknown
vulnerabilities to compromise the confidentiality, integrity, or availability of the information
being processed, stored, or transmitted by those systems. Threats to information and information
systems can include purposeful attacks, environmental disruptions, and human/machine errors
and result in great harm to the national and economic security interests of the United States.
Therefore, it is imperative that leaders and managers at all levels understand their responsibilities
and are held accountable for managing information security risk-that is, the risk associated with
the operation and use of information systems that support the missions and business functions of
their organizations.
Organizational risk can include many types of risk (e.g., program management risk, investment
risk, budgetary risk, legal liability risk, safety risk, inventory risk, supply chain risk, and security
risk). Security risk related to the operation and use of information systems is just one of many
components of organizational risk that senior leaders/executives address as part of their ongoing
risk management responsibilities. Effective risk management requires that organizations operate
in highly complex, interconnected environments using state-of-the-art and legacy information
systems-systems that organizations depend on to accomplish their missions and to conduct
important business-related functions. Leaders must recognize that explicit, well-informed risk-
based decisions are necessary in order to balance the benefits gained from the operation and use
of these information systems with the risk of the same systems being vehicles through which
purposeful attacks, environmental disruptions, or human errors cause mission or business failure.
Managing information security risk, like risk management in general, is not an exact science. It
brings together the best collective judgments of individuals and groups within organizations
responsible for strategic planning, oversight, management, and day-to-day operations-providing
both the necessary and sufficient risk response measures to adequately protect the missions and
business functions of those organizations.
5 The term organization describes an entity of any size, complexity, or positioning within an organizational structure
(e.g., a federal agency or, as appropriate, any of its operational elements) that is charged with carrying out assigned
mission/business processes and that uses information systems in support of those processes.
6 An information system is a discrete set of information resources organized for the collection, processing, maintenance,
use, sharing, dissemination, or disposition of information. In the context of this publication, the definition includes the
environment in which the information system operates (i.e., people, processes, technologies, facilities, and cyberspace).
The complex relationships among missions, mission/business processes, and the information
systems supporting those missions/processes require an integrated, organization-wide view for
managing risk.7 Unless otherwise stated, references to risk in this publication refer to information
security risk from the operation and use of organizational information systems including the
processes, procedures, and structures within organizations that influence or affect the design,
development, implementation, and ongoing operation of those systems. The role of information
security in managing risk from the operation and use of information systems is also critical to the
success of organizations in achieving their strategic goals and objectives. Historically, senior
leaders/executives have had a very narrow view of information security either as a technical
matter or in a stovepipe that was independent of organizational risk and the traditional
management and life cycle processes. This extremely limited perspective often resulted in
inadequate consideration of how information security risk, like other organizational risks, affects
the likelihood of organizations successfully carrying out their missions and business functions.
This publication places information security into the broader organizational context of achieving
mission/business success. The objective is to:
• Ensure that senior leaders/executives recognize the importance of managing information
security risk and establish appropriate governance structures for managing such risk;
• Ensure that the organization's risk management process is being effectively conducted across
the three tiers of organization, mission/business processes, and information systems;
• Foster an organizational climate where information security risk is considered within the
context of the design of mission/business processes, the definition of an overarching
enterprise architecture, and system development life cycle processes; and
• Help individuals with responsibilities for information system implementation or operation
better understand how information security risk associated with their systems translates into
organization-wide risk that may ultimately affect the mission/business success.
To successfully execute organizational missions and business functions with information system-
dependent processes, senior leaders/executives must be committed to making risk management a
fundamental mission/business requirement. This top-level, executive commitment ensures that
sufficient resources are available to develop and implement effective, organization-wide risk
management programs. Understanding and addressing risk is a strategic capability and an enabler
of missions and business functions across organizations. Effectively managing information
security risk organization-wide requires the following key elements:
• Assignment of risk management responsibilities to senior leaders/executives;
• Ongoing recognition and understanding by senior leaders/executives of the information
security risks to organizational operations and assets, individuals, other organizations, and the
Nation arising from the operation and use of information systems;
• Establishing the organizational tolerance for risk and communicating the risk tolerance
throughout the organization including guidance on how risk tolerance impacts ongoing
decision-making activities;8 and
• Accountability by senior leaders/executives for their risk management decisions and for the
implementation of effective, organization-wide risk management programs.
7 The aggregation of different types of risk across the organization is beyond the scope of this publication.
8 The evaluation of residual risk (which changes over time) to determine acceptable risk is dependent on the threshold
set by organizational risk tolerance.