Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > TIER 3 > TACTICAL RISK

TACTICAL RISK

FIGURE 2: MULTITIERED ORGANIZATION-WIDE RISK MANAGEMENT
Tier 1 addresses risk from an organizational perspective. Tier 1 implements the first component
of risk management (i.e., risk framing), providing the context for all risk management activities
carried out by organizations. Tier 1 risk management activities directly affect the activities carried
out at Tiers 2 and 3. For example, the missions and business functions defined at Tier 1 influence
the design and development of the mission/business processes created at Tier 2 to carry out those
missions/business functions. Tier 1 provides a prioritization of missions/business functions which
in turn drives investment strategies and funding decisions, thus, affecting the development of
enterprise architecture (including embedded information security architecture) at Tier 2 and the
allocations and deployment of management, operational, and technical security controls at Tier 3.
Other examples of Tier 1 activities that affect Tier 2 and Tier 3 activities include the selection of
common controls, the provision of guidance from the risk executive (function)17 to authorizing
officials, and the establishment of the order of recovery for information systems supporting
critical missions and business operations. Section 2.3 provides a more detailed description of the
specific activities associated with Tier 1.
Tier 2 addresses risk from a mission/business process perspective and is informed by the risk
context, risk decisions, and risk activities at Tier 1. Tier 2 risk management activities include: (i)
defining the mission/business processes needed to support the missions and business functions of
organizations; (ii) prioritizing the mission/business processes with respect to the strategic goals
and objectives of organizations; (iii) defining the types of information needed to successfully
execute the mission/business processes, the criticality/sensitivity of the information, and the
information flows both internal and external to organizations; (iv) incorporating information
security requirements18 into the mission/business processes; and (v) establishing an enterprise
architecture19 with embedded information security architecture20 that promotes cost-effective and
efficient information technology solutions consistent with the strategic goals and objectives of the
organization and measures of performance. Tier 2 activities directly affect the activities carried
out at Tier 3. For example, the information security architecture portion of the enterprise
architecture developed at Tier 2 influences and guides the allocation of information protection
needs which, in turn, influences and guides the allocation of the security controls to specific
components of organizational information systems at Tier 3. Enterprise architecture decisions at
Tier 2 affect the design of information systems at Tier 3 including the types of information
technologies acceptable for use in developing those systems. The activities carried out at Tier 2
can also provide useful feedback to Tier 1, possibly resulting in revisions to the organizational
risk frame or affecting risk management activities carried out at Tier 1, for example those
performed by the risk executive (function). Section 2.4 provides a more detailed description of
the specific activities associated with Tier 2.
Tier 3 addresses risk from an information system perspective and is guided by the risk context,
risk decisions and risk activities at Tiers 1 and 2. Tier 3 risk management activities include: (i)
categorizing organizational information systems; (ii) allocating security controls to organizational
information systems and the environments in which those systems operate consistent with the
organization's established enterprise architecture and embedded information security architecture;
and (iii) managing the selection, implementation, assessment, authorization, and ongoing
monitoring of allocated security controls as part of a disciplined and structured system
development life cycle process implemented across the organization. At Tier 3, information
system owners, common control providers, system and security engineers, and information
system security officers make risk-based decisions regarding the implementation, operation, and
17 The risk executive (function) is described in Section 2.3.2.
18 Information security requirements can be obtained from a variety of sources (e.g., legislation, policies, directives,
regulations, standards, and organizational mission/business/operational requirements). Organization-level security
requirements are documented in the information security program plan or equivalent document.
19 Federal Enterprise Architecture Reference Models and Segment and Solution Architectures are defined in the OMB
Federal Enterprise Architecture (FEA) Program, FEA Consolidated Reference Model Document, Version 2.3, October
2003, and OMB Federal Segment Architecture Methodology (FSAM), January 2009, respectively.
20 The information security architecture describes the security-related aspects of the enterprise architecture that are
incorporated into the enterprise architecture definition as an integral part of the architecture development-that is a
sub-architecture derived from the enterprise architecture, not a separately defined layer or architecture.
monitoring of organizational information systems. Based on these day-to-day operational risk-
based decisions, authorizing officials make follow-on risk-based decisions on whether or not the
information systems are initially authorized to operate within the designated environments of
operation or continue to receive authorization to operate on an ongoing basis. These ongoing risk-
based decisions are informed by the risk management process with guidance from the risk
executive (function) and the various architectural considerations supporting the mission/business
processes. In addition, the activities at Tier 3 provide essential feedback to Tiers 1 and 2. New
vulnerabilities discovered in an organizational information system, for example, may have
systemic implications that extend organization-wide. Those same vulnerabilities may trigger
changes to the enterprise architecture and embedded information security architecture or may
require an adjustment to the organizational risk tolerance. Section 2.5 provides a more detailed
description of the specific activities associated with Tier 3.
Since mission and business success in organizations depends on information systems, those systems
must be dependable. To be dependable in the face of sophisticated threats, the information systems
must be used wisely in accordance with the degree of protection and resilience achieved.