Guide for Conducting Risk Assessments
CHAPTER 2 > 2.3.1 Risk Models

ORGANIZATIONAL RISK FRAME

RISK MANAGEMENT STRATEGY OR APPROACH

2.3.1 Risk Models

Risk models define the risk factors to be assessed and the relationships among those factors.20
Risk factors are characteristics used in risk models as inputs to determining levels of risk in risk
assessments. Risk factors are also used extensively in risk communications to highlight what
strongly affects the levels of risk in particular situations, circumstances, or contexts. Typical risk
factors include threat, vulnerability, impact, likelihood, and predisposing condition. Risk factors
can be decomposed into more detailed characteristics (e.g., threats decomposed into threat
sources and threat events).21 These definitions are important for organizations to document prior
to conducting risk assessments because the assessments rely upon well-defined attributes of
threats, vulnerabilities, impact, and other risk factors to effectively determine risk.
Threats
A threat is any circumstance or event with the potential to adversely impact organizational
operations and assets, individuals, other organizations, or the Nation through an information
system via unauthorized access, destruction, disclosure, or modification of information, and/or
denial of service.22 Threat events are caused by threat sources. A threat source is characterized as:
(i) the intent and method targeted at the exploitation of a vulnerability; or (ii) a situation and
method that may accidentally exploit a vulnerability. In general, types of threat sources include:
(i) hostile cyber or physical attacks; (ii) human errors of omission or commission; (iii) structural
failures of organization-controlled resources (e.g., hardware, software, environmental controls);
and (iv) natural and man-made disasters, accidents, and failures beyond the control of the
organization. Various taxonomies of threat sources have been developed.23 Some taxonomies of
threat sources use the type of adverse impacts as an organizing principle. Multiple threat sources
can initiate or cause the same threat event-for example, a provisioning server can be taken off-
line by a denial-of-service attack, a deliberate act by a malicious system administrator, an
administrative error, a hardware fault, or a power failure.
Risk models differ in the degree of detail and complexity with which threat events are identified.
When threat events are identified with great specificity, threat scenarios can be modeled,
developed, and analyzed.24 Threat events for cyber or physical attacks are characterized by the
tactics, techniques, and procedures (TTPs) employed by adversaries. Understanding adversary-
based threat events gives organizations insights into the capabilities associated with certain threat
sources. In addition, having greater knowledge about who is carrying out the attacks gives
organizations a better understanding of what adversaries desire to gain by the attacks. Knowing
20 Documentation of a risk model includes: (i) identification of risk factors (definitions, descriptions, value scales); and
(ii) identification of the relationships among those risk factors (both conceptual relationships, presented descriptively,
and algorithms for combining values). The risk model presented in this section (and described in Appendices D-I) does
not specify algorithms for combining values.
21 A risk factor can have a single assessable characteristic (e.g., impact severity) or multiple characteristics, some of
which may be assessable and some of which may not be assessable. Characteristics which are not assessable typically
help determine what lower-level characteristics are relevant. For example, a threat source has a (characteristic) threat
type (using a taxonomy of threat types, which are nominal rather than assessable). The threat type determines which of
the more detailed characteristics are relevant (e.g., a threat source of type adversary has associated characteristics of
capabilities, intent, and targeting, which are directly assessable characteristics).
22 Organizations can choose to specify threat events as: (i) single events, actions, or circumstances; or (ii) sets and/or
sequences of related actions, activities, and/or circumstances.
23 Appendix D provides an exemplary taxonomy of threat sources and associated threat characteristics.
24 A threat scenario is a set of discrete threat events, attributed to a specific threat source or multiple threat sources,
ordered in time, that result in adverse effects.