Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE > INTRODUCTION

INTRODUCTION

THE NEED TO MANAGE SECURITY AND PRIVACY RISK
rganizations depend on information systems1 to carry out their missions and business
functions. The success of the missions and business functions depends on protecting the
confidentiality, integrity, availability of information processed, stored, and transmitted
by those systems and the privacy of individuals. The threats to information systems include
equipment failure, environmental disruptions, human or machine errors, and purposeful attacks
that are often sophisticated, disciplined, well-organized, and well-funded.2 When successful,
attacks on information systems can result in serious or catastrophic damage to organizational
operations3 and assets, individuals, other organizations, and the Nation.4 Therefore, it is
imperative that organizations remain vigilant and that senior executives, leaders, and managers
throughout the organization understand their responsibilities and are accountable for
protecting organizational assets and for managing risk.5
In addition to the responsibility to protect organizational assets from the threats that exist in
today's environment, organizations have a responsibility to consider and manage the risks to
individuals when information systems process personally identifiable information (PII).6 7 The
information security and privacy programs implemented by organizations have complementary
objectives with respect to managing the confidentiality, integrity, and availability of PII. While
many privacy risks arise from unauthorized activities that lead to the loss of confidentiality,
integrity, or availability of PII, other privacy risks result from authorized activities involving the
creation, collection, use, processing, storage, maintenance, dissemination, disclosure, or
disposal of PII that enables an organization to meet its mission or business objectives. For
example, organizations could fail to provide appropriate notice of PII processing depriving an
individual of knowledge of such processing or an individual could be embarrassed or stigmatized
1 An information system is a discrete set of information resources organized for the collection, processing,
maintenance, use, sharing, dissemination, or disposition of information [44 USC 3502]. The term information system
includes, for example, general-purpose computing systems; industrial/process control systems; cyber-physical
systems; weapons systems; super computers; command, control, and communications systems; devices such as smart
phones and tablets; environmental control systems; embedded devices/sensors; and paper-based systems.
2 Defense Science Board Task Force Report, Resilient Military Systems and the Advanced Cyber Threat [DSB 2013].
3 Organizational operations include mission, functions, image, and reputation.
4 Adverse impacts include, for example, compromises to systems supporting critical infrastructure applications or that
are paramount to government continuity of operations as defined by the Department of Homeland Security.
5 Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event. Risk is also a
function of the adverse impacts that arise if the circumstance or event occurs, and the likelihood of occurrence. Types
of risk include program risk; compliance/regulatory risk; financial risk; legal risk; mission/business risk; political risk;
security and privacy risk (including supply chain risk); project risk; reputational risk; safety risk; strategic planning risk.
6 [OMB A-130] defines PII as "information that can be used to distinguish or trace an individual's identity, either alone
or when combined with other information that is linked or linkable to a specific individual."
7 Organizations may also choose to consider risks to individuals that may arise from interactions with information
systems, where the processing of PII may be less impactful than the effect the system has on individuals' behavior or
activities. Such effects would constitute risks to individual autonomy and organizations may need to take steps to
manage those risks in addition to information security and privacy risks.
O