Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.1 COMPONENTS OF RISK MANAGEMENT (part 2)

(ii) determine the ongoing effectiveness of risk
response measures following implementation; and (iii) identify risk-impacting changes to
organizational information systems and the environments in which the systems operate.16 To
support the risk monitoring component, organizations describe how compliance is verified and
how the ongoing effectiveness of risk responses is determined (e.g., the types of tools, techniques,
and methodologies used to determine the sufficiency/correctness of risk responses and if risk
mitigation measures are implemented correctly, operating as intended, and producing the desired
effect with regard to reducing risk). In addition, organizations describe how changes that may
impact the ongoing effectiveness of risk responses are monitored. 14 Organizational vulnerabilities are not confined to information systems but can include, for example, vulnerabilities in
governance structures, mission/business processes, enterprise architecture, information security architecture, facilities,
equipment, system development life cycle processes, supply chain activities, and external service providers. 15 Supply chain risk management guidance is provided in NIST Interagency Report 7622. 16 Environments of operation include, but are not limited to: the threat space; vulnerabilities; missions/business
functions; mission/business processes; enterprise and information security architectures; information technologies; personnel; facilities; supply chain relationships; organizational governance/culture; procurement/acquisition processes; organizational policies/procedures; organizational assumptions, constraints, risk tolerance, and priorities/trade-offs). As indicated in the four components of risk management described above, organizations also
consider external risk relationships, as appropriate. Organizations identify external entities with
which there is an actual or potential risk relationship (i.e., organizations which could impose risks
on, transfer risks to, or communicate risks to other organizations, as well as those to which
organizations could impose, transfer, or communicate risks). External risk relationships include,
for example, suppliers, customers or served populations, mission/business partners, and/or service
providers. For organizations dealing with advanced persistent threats (i.e., a long-term pattern of
targeted, sophisticated attacks) the risk posed by external partners (especially suppliers in the
supply chain) may become more pronounced. Organizations establish practices for sharing risk-
related information (e.g., threat and vulnerability information) with external entities, including
those with which the organizations have a risk relationship as well as those which could supply or
receive risk-related information (e.g., Information Sharing and Analysis Centers [ISAC],
Computer Emergency Response Teams [CERT]). Figure 1 illustrates the risk management process and the information and communications flows
among components. The black arrows represent the primary flows within the risk management
process with risk framing informing all the sequential step-by-step set of activities moving from
risk assessment to risk response to risk monitoring. For example, one of the primary outputs from
the risk framing component is a description of the sources and methods that organizations use in
acquiring threat information (e.g., open source, classified intelligence community reports). The
output regarding threat information is a primary input to the risk assessment component and is
communicated accordingly to that component. Another example is illustrated in the primary
output from the risk assessment component-that is, a determination of risk. The output from the
risk assessment component is communicated to the risk response component and is received as a
primary input for that component. Another primary input to the risk response component is an
output from the risk framing component-the risk management strategy that defines how the
organization should respond to risk. Together, these inputs, along with any additional inputs, are
used by decision makers when selecting among potential courses of action for risk responses. Information and
Communications Flows
Information and
Communications Flows
FRAME
ASSESS
RESPOND
MONITOR
FIGURE 1: RISK MANAGEMENT PROCESS
The bidirectional nature of the arrows indicates that the information and communication flows
among the risk management components as well as the execution order of the components, may
be flexible and respond to the dynamic nature of the risk management process. For example, new
legislation, directives, or policies may require that organizations implement additional risk
response measures immediately. This information is communicated directly from the risk framing
component to the risk response component where specific activities are carried out to achieve
compliance with the new legislation, directives, or policies, illustrating the very dynamic and
flexible nature of information as it moves through the risk management process. Chapter Three
provides a complete description of the organization-wide risk management process including
specifications for inputs/preconditions, activities, and outputs/post conditions.