ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > H.3 RISK AVOIDANCE STRATEGIES

H.3 RISK AVOIDANCE STRATEGIES

Of all the risk response strategies, organizational risk avoidance strategies may be the key to
achieving adequate risk response. The pragmatic realities of the trustworthiness of information
technologies available for use within common resource constraints, make wise use of those
technologies arguably a significant, if not the most significant risk response. Wise use of the
information technologies that compose organizational information systems is fundamentally a
form of risk avoidance-that is, organizations modify how information technologies are used to
change the nature of the risk being incurred (i.e., avoid the risk). Yet such approaches can be in
great tension with organizational desires and in some cases, the mandate to fully automate
mission/business processes. Organizations proactively address this dilemma so that: (i) senior
leaders/executives (and other organizational officials making risk-based decisions) are held
accountable for only that which is within their ability to affect; and (ii) decision makers can make
the difficult risk decisions that may, in fact, be in the best interests of organizations.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > H.4 RISK SHARING AND TRANSFER STRATEGIES

H.4 RISK SHARING AND TRANSFER STRATEGIES

Organizational risk sharing strategies and risk transfer strategies are key elements in enabling
risk decisions for specific organizational missions/business functions at Tier 2 or organizational
information systems at Tier 3. Risk sharing and transfer strategies both consider and take full
advantage of a lessening of risk by sharing/transferring the potential impact across other internal
organizational elements or with other external organizations-making the case that some other
entities are, in fact, wholly (transfer) or partly (share) responsible and accountable for risk. For
risk sharing or risk transfer to be effective risk responses, the impact on the local environment
(e.g., mission/business processes or information systems) must be addressed by the sharing or
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > H.5 RISK MITIGATION STRATEGIES

H.5 RISK MITIGATION STRATEGIES

Organizational risk mitigation strategies reflect an organizational perspective on what mitigations
are to be employed and where the mitigations are to be applied, to reduce information security
risks to organizational operations and assets, individuals, other organizations, and the Nation.
Risk mitigation strategies are the primary link between organizational risk management programs
and information security programs-with the former covering all aspects of managing risk and
the latter being primarily a part of the risk response component of the risk management process.
Effective risk mitigation strategies consider the general placement and allocation of mitigations,
the degree of intended mitigation, and cover mitigations at Tier 1 (e.g., common controls), at Tier
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX F > GOVERNANCE MODELS > Hybrid Governance

Hybrid Governance

In hybrid information security governance structures, the authority, responsibility, and decision-
making power are distributed between a central body and individual subordinate organizations.
The central body establishes the policies, procedures, and processes for ensuring organization-
wide involvement in the portion of the risk management and information security strategies and
decisions affecting the entire organization (e.g., decisions related to shared infrastructure or
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > Hybrid Trust

Hybrid Trust

In general, the trust models described above are not mutually exclusive. Each of the trust models
may be used independently as a stand-alone model or in conjunction with another model. Several
trust models may be used at times within the organization (e.g., at various phases in the system
development life cycle). Also, since organizations are often large and diverse, it is possible that
subordinate organizations within a parent organization might independently employ different trust
models in establishing trust relationships with potential partnering organizations (including
subordinate organizations). The organizational governance structure may establish the specific
terms and conditions for how the various trust models are employed in a complementary manner
within the organization.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > Limitations on Strategic Investments

Limitations on Strategic Investments

The ability of organizations to provide strategic information security investments is limited.
Where the desired strategic investment funding or strategic resources33 are not available to
address specific needs, organizations may be forced to make compromises. For example,
organizations might extend the time frame required for strategic information security objectives
to be accomplished. Alternatively, organizations might prioritize risk management investments,
opting to provide resources (financial or otherwise) to address some critical strategic needs
sooner than other less critical needs. All investment decisions require organizations to prioritize
risks and to assess the potential impacts associated with alternative courses of action.
31 The threats described above are a subset of the overarching threat space that also includes errors of omission and
commission, natural disasters, and accidents.
32 This investment strategy is a change from vulnerability and patch management to a longer-term strategy addressing
information security gaps such as the lack of information technology products with the trustworthiness necessary to
achieve information system resilience in the face of advanced persistent threats.
33 In some instances, the limitations may not be financial in nature, but limitations in the number of individuals with the
appropriate skills/expertise or limitations regarding the state of technology.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > Mandated Trust

Mandated Trust

In the mandated trust model, an organization establishes a level of trust with another organization
based on a specific mandate issued by a third party in a position of authority.78 This mandate can
be established by the respective authority through Executive Orders, directives, regulations, or
policies (e.g., a memorandum from an agency head directing that all subordinate organizations
accept the results of security assessments conducted by any subordinate organization within the
agency). Mandated trust can also be established when some organizational entity is decreed to be
the authoritative source for the provision of information resources including information
technology products, systems, or services. For example, an organization may be given the
responsibility and the authority to issue Public Key Infrastructure (PKI) certificates for a group of
organizations.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > TRUST MODELS > Mediated Trust

Mediated Trust

In the mediated trust model, an organization establishes a level of trust with another organization
based on assurances provided by some mutually trusted third party. There are several types of
mediated trust models that can be employed. For example, two organizations attempting to
establish a trust relationship may not have a direct trust history between the two organizations,
but do have a trust relationship with a third organization. The third party that is trusted by both
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > Mission and Risk Priorities

Mission and Risk Priorities

Organizations generally conduct a variety of missions and are involved in different types of
business functions. This is especially true for large and complex organizations that have different
organizational components, each of which is typically focused on one or two primary missions.
While all of these organizational components and associated missions/business functions are
likely to be important and play a key role in the overall success of organizations, in reality they
are not of equal importance. The greater the criticality of organizational missions and business
functions, the greater the necessity for organizations to ensure that risks are adequately managed.
Such missions and business functions are likely to require a greater degree of risk management
investments than missions/business functions deemed less critical. The determination of the
relative importance of the missions/business functions and hence the level of risk management
investment, is something that is decided upon at Tier 1, executed at Tier 2, and influences risk
management activities at Tier 3.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX A > REFERENCES

REFERENCES

LAWS, POLICIES, DIRECTIVES, INSTRUCTIONS, STANDARDS, AND GUIDELINES
LEGISLATION
1.
E-Government Act [includes FISMA] (P.L. 107-347), December 2002.
2.
Federal Information Security Management Act (P.L. 107-347, Title III), December 2002.
POLICIES, DIRECTIVES, INSTRUCTIONS
1.
Committee on National Security Systems (CNSS) Instruction 4009, National Information
Assurance (IA) Glossary, April 2010.
2.
Committee on National Security Systems (CNSS) Instruction 1253, Security
Categorization and Control Selection for National Security Systems, October 2009.
3.
Office of Management and Budget, Circular A-130, Appendix III, Transmittal
Memorandum #4, Management of Federal Information Resources, November 2000.
STANDARDS
1.
Standards Publication 199, Standards for Security Categorization of Federal Information
and Information Systems, February 2004.
2.
Standards Publication 200, Minimum Security Requirements for Federal Information and
Information Systems, March 2006.
3.
ISO/IEC 15408:2005, Common Criteria for Information Technology Security Evaluation,
2005.
GUIDELINES
1.
Guide for Developing Security Plans for Federal Information Systems, February 2006.
2.
Guide for Conducting Risk Assessments, (Projected Publication Spring 2011).
3.
Guide for Applying the Risk Management Framework to Federal Information Systems: A
Security Life Cycle Approach, February 2010.
4.
Recommended Security Controls for Federal Information Systems and Organizations,
August 2009.
5.
Guide for Assessing the Security Controls in Federal Information Systems and
Organizations: Building Effective Security Assessment Plans, June 2010.
6.
Identifying an Information System as a National Security System, August 2003.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > RISK RESPONSE STRATEGIES

RISK RESPONSE STRATEGIES

FROM BOUNDARY PROTECTION TO AGILE DEFENSES
O
rganizations develop risk management strategies as part of the risk framing step in the
risk management process described in Chapter Three. The risk management strategies
address how organizations intend to assess risk, respond to risk, and monitor risk-
making explicit and transparent the risk perceptions that organizations routinely use in making
both investment and operational decisions. As part of organizational risk management strategies,
organizations also develop risk response strategies. The practical realities facing organizations
today make risk response strategies essential-the realities of needing the mission/business
effectiveness offered by information technology, the lack of trustworthiness in the technologies
available, and the growing awareness by adversaries of the potential to achieve their objectives to
cause harm by compromising organizational information systems and the environments in which
those systems operate. Senior leaders/executives in modern organizations are faced with an
almost intractable dilemma-that is, the information technologies needed for mission/business
success may be the same technologies through which adversaries cause mission/business failure.
The risk response strategies developed and implemented by organizations provide these senior
leaders/executives (i.e., decision makers within organizations) with practical, pragmatic paths for
dealing with this dilemma. Clearly defined and articulated risk response strategies help to ensure
that senior leaders/executives take ownership of organizational risk responses and are ultimately
responsible and accountable for risk decisions-understanding, acknowledging, and explicitly
accepting the resulting mission/business risk.
As described in Chapter Two, there are five basic types of responses to risk: (i) accept; (ii) avoid;
(iii) mitigate; (iv) share; and (v) transfer.79 While each type of response can have an associated
strategy, there should be an overall strategy for selecting from among the basic response types.
This overall risk response strategy and a strategy for each type of response are discussed below.
In addition, specific risk mitigation strategies are presented, including a description of how such
strategies can be implemented within organizations.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > ROLES AND RESPONSIBILITIES

CNSS

Committee on National Security Systems

COTS

Commercial Off-The-Shelf
DoD
Department of Defense

FIPS

Federal Information Processing Standards

FISMA

Federal Information Security Management Act

IEC

International Electrotechnical Commission

ISO

International Organization for Standardization

ODNI

Office of the Director of National Intelligence

SCAP

Security Content Automation Protocol

SP

Special Publication
U.S.C.
United States Code

ROLES AND RESPONSIBILITIES

KEY PARTICIPANTS IN THE RISK MANAGEMENT PROCESS
T
he following sections describe the roles and responsibilities66 of key participants involved
in an organization's risk management process.67 Recognizing that organizations have
widely varying missions and organizational structures, there may be differences in naming
conventions for risk management-related roles and how specific responsibilities are allocated
among organizational personnel (e.g., multiple individuals filling a single role or one individual
filling multiple roles).68 However, the basic functions remain the same. The application of the risk
management process across the three risk management tiers described in this publication is
flexible, allowing organizations to effectively accomplish the intent of the specific tasks within
their respective organizational structures to best manage risk.
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.2 ASSESSING RISK > STEP 2: RISK ASSESSMENT

STEP 2: RISK ASSESSMENT

Inputs and Preconditions
Inputs to the risk assessment step from the risk framing step include, for example: (i) acceptable risk assessment
methodologies; (ii) the breadth and depth of analysis employed during risk assessments; (iii) the level of granularity
required for describing threats; (iv) whether/how to assess external service providers; and (v) whether/how to aggregate
risk assessment results from different organizational entities or mission/business functions to the organization as a
whole. Organizational expectations regarding risk assessment methodologies, techniques, and/or procedures are shaped
heavily by governance structures, risk tolerance, culture, trust, and life cycle processes. Prior to conducting risk
assessments, organizations understand the fundamental reasons for conducting the assessments and what constitutes
adequate depth and breadth for the assessments. Risk assumptions, risk constraints, risk tolerance, and priorities/trade
offs defined during the risk framing step shape how organizations use risk assessments-for example, localized
applications of the risk assessments within each of the risk management tiers (i.e., governance, mission/business
process, information systems) or global applications of the risk assessments across the entire organization. Risk
assessments can be conducted by organizations even when some of the inputs from the risk framing step have not been
received or preconditions established. However, in those situations, the quality of the risk assessment results may be
affected. In addition to the risk framing step, the risk assessment step can receive inputs from the risk monitoring step,
especially during mission operations and the operations/maintenance phase of the system development life cycle (e.g.,
when organizations discover new threats or vulnerabilities that require an immediate reassessment of risk). The risk
assessment step can also receive inputs from the risk response step (e.g., when organizations are considering the risk of
employing new technology-based solutions as alternatives for risk reduction measures). As courses of action are
developed in the risk response step, a differential risk assessment may be needed to evaluate differences that each
course of action makes in the overall risk determination.
Activities
THREAT AND VULNERABILITY IDENTIFICATION
Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.3 RESPONDING TO RISK > STEP 3: RISK RESPONSE

STEP 3: RISK RESPONSE

Inputs and Preconditions
Inputs from the risk assessment and risk framing steps include: (i) identification of threat sources and threat events; (ii)
identification of vulnerabilities that are subject to exploitation; (iii) estimates of potential consequences and/or impact if
63 A course of action is a time-phased or situation-dependent combination of risk response measures. A risk response
measure is a specific action taken to respond to an identified risk. Risk response measures can be separately managed
and can include, for example, the implementation of security controls to mitigate risk, promulgation of security policies
to avoid risk or to accept risk in specific circumstances, and organizational agreements to share or transfer risk.
threats exploit vulnerabilities; (iv) likelihood estimates that threats exploit vulnerabilities; (v) a determination of risk to
organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other
organizations, and the Nation; (vi) risk response guidance from the organizational risk management strategy (see
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > 3.4 MONITORING RISK > STEP 4: RISK MONITORING

STEP 4: RISK MONITORING

Inputs and Preconditions
Inputs to this step include implementation strategies for selected courses of action for risk responses and the actual
implementation of selected courses of action. In addition to the risk response step, the risk monitoring step can receive
inputs from the risk framing step (e.g., when organizations become aware of an advanced persistent threat reflecting a
change in threat assumptions, this may result in a change in the frequency of follow on monitoring activities). The risk
framing step also directly shapes the resource constraints associated with establishing and implementing an
organization-wide monitoring strategy. In some instances, outputs from the risk assessment step may be useful inputs to
the risk monitoring step. For example, risk assessment threshold conditions (e.g., likelihood of threats exploiting
vulnerabilities) could be input to the risk monitoring step. In turn, organizations could monitor to determine if such
threshold conditions are met. If threshold conditions are met, such information could be used in the risk assessment
step, where it could serve as the basis for an incremental, differential risk assessment or an overall reassessment of risk
to the organization.
Activities
RISK MONITORING STRATEGY
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > Suitability of Various Trust Models

Suitability of Various Trust Models

The trust models can be employed at various tiers in the risk management approach described in
this publication. None of the trust models is inherently better or worse than the others. However,
some models may be better suited to some situations than others. For example, the validated trust
model, because it requires evidence of a technical nature (e.g., tests completed successfully), is
probably best suited for application at Tier 3. In contrast, the direct historical trust model, with a
significant emphasis on past experiences, is more suited for application at Tiers 1 or 2. The
mediated and mandated trust models are typically more oriented toward governance and
consequently are best suited for application at Tier 1. However, some implementations of the
mandated trust model, for example, being required to trust the source of a PKI certificate, are
more oriented toward Tier 3. Similarly, although the mediated trust model is primarily oriented
toward Tier 1, there can be implementations of it that are more information system-, or Tier 3
77 In the mediated trust model, the first organization typically has no insight into the nature of the trust relationship
between the second and third organizations.
78 The authoritative organization explicitly accepts the risks to be incurred by all organizations covered by the mandate
and is accountable for the risk-related decisions imposed by the organization.