ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER ONE > 1.2 TARGET AUDIENCE

1.2 TARGET AUDIENCE

This publication is intended to serve a diverse group of risk management professionals including:
• Individuals with oversight responsibilities for risk management (e.g., heads of agencies, chief
executive officers, chief operating officers);
• Individuals with responsibilities for conducting organizational missions/business functions
(e.g., mission/business owners, information owners/stewards, authorizing officials);
• Individuals with responsibilities for acquiring information technology products, services, or
information systems (e.g., acquisition officials, procurement officers, contracting officers);
• Individuals with information security oversight, management, and operational responsibilities
(e.g., chief information officers, senior information security officers,10 information security
managers, information system owners, common control providers);
9 An executive agency is: (i) an executive department specified in 5 U.S.C., Section 101; (ii) a military department
specified in 5 U.S.C., Section 102; (iii) an independent establishment as defined in 5 U.S.C., Section 104(1); and (iv) a
wholly owned government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. In this publication, the
term executive agency is synonymous with the term federal agency.
10 At the agency level, this position is known as the Senior Agency Information Security Officer. Organizations may
also refer to this position as the Chief Information Security Officer.
• Individuals with information system/security design, development and implementation
responsibilities (e.g., program managers, enterprise architects, information security architects,
information system/security engineers; information systems integrators); and
• Individuals with information security assessment and monitoring responsibilities (e.g., system
evaluators, penetration testers, security control assessors, independent verifiers/validators,
inspectors general, auditors).
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER ONE > 1.3 RELATED PUBLICATIONS

1.3 RELATED PUBLICATIONS

The risk management approach described in this publication is supported by a series of security
standards and guidelines necessary for managing information security risk. In particular, the
Special Publications developed by the Joint Task Force Transformation Initiative11 supporting the
unified information security framework for the federal government include:
• Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal
Information Systems: A Security Life Cycle Approach;
• Special Publication 800-53, Recommended Security Controls for Federal Information
Systems and Organizations;
• Special Publication 800-53A, Guide for Assessing the Security Controls in Federal
Information Systems and Organizations; and
• Draft Special Publication 800-30, Guide for Conducting Risk Assessments.12
In addition to the Joint Task Force publications listed above, the International Organization for
Standardization (ISO) and the International Electrotechnical Commission (IEC) publish standards
for risk management and information security including:
• ISO/IEC 31000, Risk management - Principles and guidelines;
• ISO/IEC 31010, Risk management - Risk assessment techniques;
• ISO/IEC 27001, Information technology - Security techniques - Information security
management systems - Requirements; and
• ISO/IEC 27005, Information technology - Security techniques - Information security risk
management systems.
NIST's mission includes harmonization of international and national standards where appropriate.
The concepts and principles contained in this publication are intended to implement for federal
information systems and organizations, an information security management system and a risk
management process similar to those described in ISO/IEC standards. This reduces the burden on
organizations that must conform to both ISO/IEC standards and NIST standards and guidance.
11 An overview of each Joint Task Force Transformation Initiative publication, similar to an Executive Summary, can
be obtained through appropriate NIST ITL Security Bulletins at http://csrc.nist.gov.
12 Special Publication 800-39 supersedes the original Special Publication 800-30 as the source for guidance on risk
management. Special Publication 800-30 is being revised to provide guidance on risk assessment as a supporting
document to Special Publication 800-39.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER ONE > 1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows:
• Chapter Two describes: (i) the components of risk management; (ii) the multitiered risk
management approach; (iii) risk management at the organization level (Tier 1); (iv) risk
management at the mission/business process level (Tier 2); (v) risk management at the
information system level (Tier 3); (vi) risk related to trust and trustworthiness; (vii) the
effects of organizational culture on risk; and (viii) relationships among key risk management
concepts.
• Chapter Three describes a life cycle-based process for managing information security risk
including: (i) a general overview of the risk management process; (ii) how organizations
establish the context for risk-based decisions; (iii) how organizations assess risk; (iv) how
organizations respond to risk; and (v) how organizations monitor risk over time.
• Supporting appendices provide additional risk management information including: (i)
general references; (ii) definitions and terms; (iii) acronyms; (iv) roles and responsibilities;
(v) risk management process tasks; (vi) governance models; (vii) trust models; and (viii) risk
response strategies.
Managing Information Security Risk: Organization, Mission, and Information System View
2 (e.g., enterprise architecture including embedded information security architecture, and risk-

2 (e.g., enterprise architecture including embedded information security architecture, and risk-

aware mission/business processes), and at Tier 3 (security controls in individual information
systems). Organizational risk mitigation strategies reflect the following:
• Mission/business processes are designed with regard to information protection needs and
information security requirements;80
• Enterprise architectures (including embedded information security architectures) are designed
with consideration for realistically achievable risk mitigations;
• Risk mitigation measures are implemented within organizational information systems and
environments of operation by safeguards/countermeasure (i.e., security controls) consistent
with information security architectures; and
• Information security programs, processes, and safeguards/countermeasures are highly flexible
and agile with regard to implementation, recognizing the diversity in organizational missions
and business functions and the dynamic environments in which the organizations operate.81
Organizations develop risk mitigation strategies based on strategic goals and objectives, mission
and business requirements, and organizational priorities. The strategies provide the basis for
making risk-based decisions on the information security solutions associated with and applied to
information systems within the organization. Risk mitigation strategies are necessary to ensure
that organizations are adequately protected against the growing threats to information processed,
stored, and transmitted by organizational information systems. The nature of the threats and the
dynamic environments in which organizations operate, demand flexible and scalable defenses as
well as solutions that can be tailored to meet rapidly changing conditions. These conditions
include, for example, the emergence of new threats and vulnerabilities, the development of new
technologies, changes in missions/business requirements, and/or changes to environments of
operation. Effective risk mitigation strategies support the goals and objectives of organizations
and established mission/business priorities, are tightly coupled to enterprise architectures and
information security architectures, and can operate throughout the system development life cycle.
80 In addition to mission/business-driven information protection needs, information security requirements are obtained
from a variety of sources (e.g., federal legislation, policies, directives, regulations, and standards).
81 Dynamic environments of operation are characterized, for example, by ongoing changes in people, processes,
technologies, physical infrastructure, and threats.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.2 MULTITIERED RISK MANAGEMENT

2.2 MULTITIERED RISK MANAGEMENT

To integrate the risk management process throughout the organization, a three-tiered approach is
employed that addresses risk at the: (i) organization level; (ii) mission/business process level; and
(iii) information system level. The risk management process is carried out seamlessly across the
three tiers with the overall objective of continuous improvement in the organization's risk-related
activities and effective inter-tier and intra-tier communication among all stakeholders having a
shared interest in the mission/business success of the organization. Figure 2 illustrates the three-
tiered approach to risk management along with some of its key characteristics.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW

2.3 TIER ONE-ORGANIZATION VIEW

Tier 1 addresses risk from an organizational perspective by establishing and implementing
governance structures that are consistent with the strategic goals and objectives of organizations
and the requirements defined by federal laws, directives, policies, regulations, standards, and
missions/business functions. Governance structures provide oversight for the risk management
activities conducted by organizations and include: (i) the establishment and implementation of a
risk executive (function); (ii) the establishment of the organization's risk management strategy
including the determination of risk tolerance; and (iii) the development and execution of
organization-wide investment strategies for information resources and information security.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > 2.3.4 Investment Strategies

2.3.4 Investment Strategies

Investment strategies30 play a significant role in organizational risk management efforts. These
strategies generally reflect the long-term strategic goals and objectives of organizations and the
associated risk management strategies developed and executed to ensure mission and business
success. Underlying all investment strategies is the recognition that there is a finite amount of
resources available to invest in helping organizations effectively manage risk-that is, effectively
addressing risk to achieve on-going mission/business success.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.4 TIER TWO—MISSION/BUSINESS PROCESS VIEW

2.4 TIER TWO-MISSION/BUSINESS PROCESS VIEW

Tier 2 addresses risk from a mission/business process perspective by designing, developing, and
implementing mission/business processes that support the missions/business functions defined at
Tier 1. Organizational mission/business processes guide and inform the development of an
enterprise architecture that provides a disciplined and structured methodology for managing the
complexity of the organization's information technology infrastructure. A key component of the
enterprise architecture is the embedded information security architecture that provides a roadmap
to ensure that mission/business process-driven information security requirements and protection
needs are defined and allocated to appropriate organizational information systems and the
environments in which those systems operate.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.4 TIER TWO—MISSION/BUSINESS PROCESS VIEW > 2.4.1 Risk-Aware Mission/Business Processes

2.4.1 Risk-Aware Mission/Business Processes

The risk management activities at Tier 2 begin with the identification and establishment of risk-
aware mission/business processes to support the organizational missions and business functions.
A risk-aware mission/business process is one that explicitly takes into account the likely risk such
a process would cause if implemented. Risk aware processes are designed to manage risk in
accordance with the risk management strategy defined at Tier 1 and explicitly account for risk
when evaluating the mission/business activities and decisions at Tier 2.34 Implementing risk-
aware mission/business processes requires a thorough understanding of the organizational
missions and business functions and the relationships among missions/business functions and
supporting processes. This understanding is a prerequisite to building mission/business processes
sufficiently resilient to withstand a wide variety of threats including routine and sophisticated
cyber attacks, errors/accidents, and natural disasters. An important part of achieving risk-aware
processes is the understanding of senior leaders/executives of: (i) the types of threat sources and
threat events that can adversely affect the ability of organizations to successfully execute their
missions/business functions); (ii) the potential adverse impacts/consequences on organizational
operations and assets, individuals, other organizations, or the Nation if the confidentiality,
integrity, or availability of information or information systems used in a mission/business process
is compromised; and (iii) the likely resilience to such a compromise that can be achieved with a
given mission/business process definition, applying realistic expectations for the resilience of
information technology.
A key output from the Tier 2 definition of mission/business processes is the selected risk response
strategy35 for these processes within the constraints defined in the risk management strategy. The
risk response strategy includes identification of information protection needs and the allocation of
those needs across components of the process (e.g., allocation to protections within information
systems, protections in the operational environments of those systems, and allocation to alternate
mission/business execution paths based on the potential for compromise).
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.4 TIER TWO—MISSION/BUSINESS PROCESS VIEW > 2.4.3 Information Security Architecture

2.4.3 Information Security Architecture

The information security architecture is an integral part of the organization's enterprise
architecture. It represents that portion of the enterprise architecture specifically addressing
information system resilience and providing architectural information for the implementation of
security capabilities.37 The primary purpose of the information security architecture is to ensure
that mission/business process-driven information security requirements are consistently and cost-
effectively achieved in organizational information systems and the environments in which those
systems operate consistent with the organizational risk management strategy.38 The information
security architecture also incorporates security requirements from legislation, directives, policies,
regulations, standards, and guidance into the segment architecture. Ultimately, the information
security architecture provides a detailed roadmap that allows traceability from the highest-level
strategic goals and objectives of organizations, through specific mission/business protection
needs, to specific information security solutions provided by people, processes, and technologies.
37 In general, a version of an information security architecture exists for each of the enterprise architecture reference
models; including Performance, Business, Service Component, Data, and Technical.
38 Organizations employ sound system and security engineering principles and techniques to ensure that information
security requirements are effectively implemented in organizational information systems.
Information security requirements defined in the segment architecture are implemented in the
solution architecture in the form of management, operational, and technical security controls. The
security controls are employed within or inherited by the individual information systems and the
environments in which the systems operate. The allocation39 of security controls is consistent with
the information security architecture as well as concepts such as defense-in-depth and defense-in
breadth. Figure 3 illustrates the process of integrating information security requirements into the
enterprise architecture and the associated information systems supporting the mission/business
processes of organizations.
Environments of Operation
INFORMATION
SYSTEM
INFORMATION
SYSTEM
INFORMATION
SYSTEM
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.5 TIER THREE—INFORMATION SYSTEMS VIEW (part 2)

44 Security functionality is the set of security controls employed within or inherited by an information system or the
environment in which the system operates. The security controls, described in NIST Special Publication 800-53, are
implemented by a combination of people, processes, and technologies. corrections when risk exceeds organizational risk tolerance. During the disposal phase of the
system development life cycle, it is standard procedure for organizations to verifiably remove
prior to disposal, any information from information systems that may cause adverse impacts, if
compromised, and also assess any risk associated with these activities.45
Early integration of information security requirements into the system development life cycle is
the most cost-effective method for implementing the organizational risk management strategy at
Tier 3.46 Incorporating risk management into the system development life cycle ensures that the
risk management process is not isolated from the other management processes employed by the
organization to develop, acquire, implement, operate, and maintain the information systems
supporting organizational missions and business functions. To support system development life
cycle integration, risk management (including information security considerations) is also
incorporated into program, planning, and budgeting activities to help ensure that appropriate
resources are available when needed-thus facilitating the completion of program and project
milestones established by organizations. To incorporate risk management into program, planning
and budgeting activities, risk and information security professionals are an integral part of the
teams and structures used to address information system and organizational requirements. The overall resilience of organizational information systems (i.e., how well systems operate while
under stress) is a key factor and performance measure in determining the potential survivability of
missions/business functions. The use of certain information technologies may introduce inherent
vulnerabilities into these information systems-resulting in risk that may have to be mitigated by
reengineering the current mission/business processes. The wise use of information technologies
during the design, development, and implementation of organizational information systems is of
paramount importance in managing risk. Making information security‐related requirements and activities an integral part of the system
development life cycle ensures that senior leaders/executives consider the risks to organizational
operations and assets, individuals, other organizations, and the Nation resulting from the operation
and use of information systems and take appropriate actions to exercise the organization's due
diligence.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.6 TRUST AND TRUSTWORTHINESS

2.6 TRUST AND TRUSTWORTHINESS

Trust is an important concept related to risk management. How organizations approach trust
influences their behaviors and their internal and external trust relationships. This section
introduces some conceptual ways of thinking about trust, defines the concept of trustworthiness,
and shows how the concept of trustworthiness can be used in developing trust relationships.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS

2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS

As indicated by the discussions above, there are a variety of risk-related concepts (e.g., risk
tolerance, trust, and culture), all of which have an impact on risk management. The concepts do
not operate in a vacuum; rather, there is often a strong interplay among the concepts (e.g., an
organization's culture along with its governance structures and processes, often influences the
pace of change and the implementation of its risk management strategy). For this reason, the risk
executive (function) and other parties involved in organizational risk-based decisions, need to
have an awareness and appreciation for all of the concepts. Several examples of the relationships
among the risk-related concepts are provided below. The list of relationships is not exhaustive
and serves only to illustrate how combining risk-related concepts can produce unintended
consequences, both positive and negative in scope.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.8 RELATIONSHIP AMONG KEY RISK CONCEPTS > 2.8.1 Governance, Risk Tolerance, and Trust

2.8.1 Governance, Risk Tolerance, and Trust

As part of implementing the organization's risk management strategy at Tier 1, the risk executive
(function) establishes practices for sharing risk-related information with external entities. With
regard to the demonstration of due diligence for managing risk, organizations that are less risk
tolerant are likely to require more supporting evidence than organizations that are more risk
tolerant. Such organizations may only trust (and hence partner with) organizations with which
they have had a long and successful relationship (see direct historical trust model in Appendix G).
The amount of centralization59 within an organization may be reflective of the organizational risk
tolerance and/or its willingness to trust partnering organizations. Some organizations select a
58 A similar situation can exist between subordinate elements of an organization when these elements are afforded a fair
amount of autonomy and operational authority.
59 Additional information on governance models can be found in Appendix F.
decentralized governance structure for reasons such as widely diverging mission/business areas or
need for increased separation between mission/business lines due to sensitivity of the work. The
reasons for decentralization may reflect and likely will influence risk tolerance. For instance, if
there are no partnering organizations meeting the established trust qualifications, less risk-tolerant
organizations may require significantly more supporting evidence of due diligence (e.g., access to
risk assessments, security plans, security assessment reports, risk acceptance decisions) than is
typically required in such situations (see validated trust model in Appendix G).