Guide for Conducting Risk Assessments
CHAPTER 2 > 2.3.4 Effects of Organizational Culture on Risk Assessments

2.3.4 Effects of Organizational Culture on Risk Assessments

Organizations can differ in the risk models, assessment approaches, and analysis approaches that
they prefer for a variety of reasons. For example, cultural issues33 can predispose organizations to
employ risk models that assume a constant value for one or more possible risk factors, so that
some factors that are present in other organizations' models are not represented. Culture can also
predispose organizations to employ risk models that require detailed analyses using quantitative
assessments (e.g., nuclear safety). Alternately, organizations may prefer qualitative or semi-
quantitative assessment approaches. In addition to differences among organizations, differences
can also exist within organizations. For example, organizations can use coarse or high-level risk
models early in the system development life cycle to select security controls, and subsequently,
more detailed models to assess risk to given missions or business functions. Organizational risk
frames34 determine which risk models, assessment approaches, and analysis approaches to use
under varying circumstances.
33 NIST Special Publication 800-39 describes how organizational culture affects risk management.
34 NIST Special Publication 800-39 defines an organization's risk frame as the set of assumptions, constraints, risk
tolerances, priorities, and trade-offs that underpin the organization's risk management strategy-establishing a solid
foundation for managing risk and bounding its risk-based decisions.
THE USE OF RISK MODELS
A single risk model (consisting of a fixed set of factors, a fixed assessment scale for each factor, and a
fixed algorithm for combining factors) cannot meet the diverse needs of the organizations in the public
and private sectors that rely on Special Publication 800-30. For example, while some organizations may
emphasize adversarial threats and provide detailed information about such threats, other organizations
may choose instead to focus on non-adversarial threats, providing greater detail for those types of
threats and lesser detail for adversarial threats. Therefore, the risk models developed by organizations
with different assumptions regarding threats will involve different factors as well as different levels of
detail.
Similarly, within a single organization or community of interest, different assessment scales may be
appropriate for different missions/business functions, different categories of information systems, and/or
for systems at different stages in the system development life cycle. For example, during an initial risk
assessment performed when an information system is first being considered, the information available
about threats and vulnerabilities may be nonspecific and highly uncertain. For such risk assessments, a
qualitative assessment, using only a few factors, may be appropriate. By contrast, a risk assessment
informed by a security controls assessment can be far more specific, and estimates can be made with
greater fidelity. For such assessments, a semi-quantitative assessment using the 0-100 value scales
may be more appropriate.
The expectation set forth in Special Publications 800-39 and 800-30 is that each organization or
community will define a risk model appropriate to its view of risk (i.e., formulas that reflect organizational
or community views of which risk factors must be considered, which factors can be combined, which
factors must be further decomposed, and how assessed values should be combined algorithmically).
Special Publication 800-30 does identify risk factors that are common across a wide spectrum of risk
models. In addition, by defining multiple aligned value scales, this publication provides a foundation for a
consistent approach to estimating information security risk across the system development life cycle,
without forcing assessments early in the life cycle to be more detailed than can be justified by available
information.