Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.1 COMPONENTS OF RISK MANAGEMENT (part 1)

2.1 COMPONENTS OF RISK MANAGEMENT

2.1 COMPONENTS OF RISK MANAGEMENT

Managing risk is a complex, multifaceted activity that requires the involvement of the entire
organization-from senior leaders/executives providing the strategic vision and top-level goals
and objectives for the organization; to mid-level leaders planning, executing, and managing
projects; to individuals on the front lines operating the information systems supporting the
organization's missions/business functions. Risk management is a comprehensive process that
requires organizations to: (i) frame risk (i.e., establish the context for risk-based decisions); (ii)
assess risk; (iii) respond to risk once determined; and (iv) monitor risk on an ongoing basis using
effective organizational communications and a feedback loop for continuous improvement in the
risk-related activities of organizations. Risk management is carried out as a holistic, organization-
wide activity that addresses risk from the strategic level to the tactical level, ensuring that risk-
based decision making is integrated into every aspect of the organization.13 The following
sections briefly describe each of the four risk management components. The first component of risk management addresses how organizations frame risk or establish a
risk context-that is, describing the environment in which risk-based decisions are made. The
purpose of the risk framing component is to produce a risk management strategy that addresses
how organizations intend to assess risk, respond to risk, and monitor risk-making explicit and
transparent the risk perceptions that organizations routinely use in making both investment and
operational decisions. The risk frame establishes a foundation for managing risk and delineates
the boundaries for risk-based decisions within organizations. Establishing a realistic and credible
risk frame requires that organizations identify: (i) risk assumptions (e.g., assumptions about the
threats, vulnerabilities, consequences/impact, and likelihood of occurrence that affect how risk is
assessed, responded to, and monitored over time); (ii) risk constraints (e.g., constraints on the risk
assessment, response, and monitoring alternatives under consideration); (iii) risk tolerance (e.g.,
levels of risk, types of risk, and degree of risk uncertainty that are acceptable); and (iv) priorities
and trade-offs (e.g., the relative importance of missions/business functions, trade-offs among
different types of risk that organizations face, time frames in which organizations must address
risk, and any factors of uncertainty that organizations consider in risk responses). The risk
framing component and the associated risk management strategy also include any strategic-level
decisions on how risk to organizational operations and assets, individuals, other organizations,
and the Nation, is to be managed by senior leaders/executives. 13 Integrated, enterprise-wide risk management includes, for example, consideration of: (i) the strategic goals/objectives
of organizations; (ii) organizational missions/business functions prioritized as needed; (iii) mission/business processes; (iv) enterprise and information security architectures; and (v) system development life cycle processes. The second component of risk management addresses how organizations assess risk within the
context of the organizational risk frame. The purpose of the risk assessment component is to
identify: (i) threats to organizations (i.e., operations, assets, or individuals) or threats directed
through organizations against other organizations or the Nation; (ii) vulnerabilities internal and
external to organizations;14 (iii) the harm (i.e., consequences/impact) to organizations that may
occur given the potential for threats exploiting vulnerabilities; and (iv) the likelihood that harm
will occur. The end result is a determination of risk (i.e., the degree of harm and likelihood of
harm occurring). To support the risk assessment component, organizations identify: (i) the tools,
techniques, and methodologies that are used to assess risk; (ii) the assumptions related to risk
assessments; (iii) the constraints that may affect risk assessments; (iv) roles and responsibilities; (v) how risk assessment information is collected, processed, and communicated throughout
organizations; (vi) how risk assessments are conducted within organizations; (vii) the frequency
of risk assessments; and (viii) how threat information is obtained (i.e., sources and methods). The third component of risk management addresses how organizations respond to risk once that
risk is determined based on the results of risk assessments. The purpose of the risk response
component is to provide a consistent, organization-wide, response to risk in accordance with the
organizational risk frame by: (i) developing alternative courses of action for responding to risk; (ii) evaluating the alternative courses of action; (iii) determining appropriate courses of action
consistent with organizational risk tolerance; and (iv) implementing risk responses based on
selected courses of action. To support the risk response component, organizations describe the
types of risk responses that can be implemented (i.e., accepting, avoiding, mitigating, sharing, or
transferring risk). Organizations also identify the tools, techniques, and methodologies used to
develop courses of action for responding to risk, how courses of action are evaluated, and how
risk responses are communicated across organizations and as appropriate, to external entities
(e.g., external service providers, supply chain partners).15
The fourth component of risk management addresses how organizations monitor risk over time. The purpose of the risk monitoring component is to: (i) verify that planned risk response
measures are implemented and information security requirements derived from/traceable to
organizational missions/business functions, federal legislation, directives, regulations, policies,
and standards, and guidelines, are satisfied;