Guide for Conducting Risk Assessments
CHAPTER 2

Organizations typically employ a three-step process to determine the overall likelihood of threat
events. First, organizations assess the likelihood that threat events will be initiated (for adversarial
threat events) or will occur (for non-adversarial threat events). Second, organizations assess the
likelihood that the threat events once initiated or occurring, will result in adverse impacts or harm
to organizational operations and assets, individuals, other organizations, or the Nation. Finally,
organizations assess the overall likelihood as a combination of likelihood of initiation/occurrence
and likelihood of resulting in adverse impact.
Threat-vulnerability pairing (i.e., establishing a one-to-one relationship between threats and
vulnerabilities) may be undesirable when assessing likelihood at the mission/business function
level, and in many cases, can be problematic even at the information system level due to the
potentially large number of threats and vulnerabilities. This approach typically drives the level of
detail in identifying threat events and vulnerabilities, rather than allowing organizations to make
effective use of threat information and/or to identify threats at a level of detail that is meaningful.
Depending on the level of detail in threat specification, a given threat event could exploit multiple
vulnerabilities. In assessing likelihoods, organizations examine vulnerabilities that threat events
could exploit and also the mission/business function susceptibility to events for which no security
controls or viable implementations of security controls exist (e.g., due to functional dependencies,
particularly external dependencies). In certain situations, the most effective way to reduce
mission/business risk attributable to information security risk is to redesign the mission/business
processes so there are viable work-arounds when information systems are compromised. Using
the concept of threat scenarios described above, may help organizations overcome some of the
limitations of threat-vulnerability pairing.
Impact
The level of impact from a threat event is the magnitude of harm that can be expected to result
from the consequences of unauthorized disclosure of information, unauthorized modification of
information, unauthorized destruction of information, or loss of information or information
system availability. Such harm can be experienced by a variety of organizational and non-
organizational stakeholders including, for example, heads of agencies, mission and business
owners, information owners/stewards, mission/business process owners, information system
owners, or individuals/groups in the public or private sectors relying on the organization-in
essence, anyone with a vested interest in the organization's operations, assets, or individuals,
including other organizations in partnership with the organization, or the Nation.28 Organizations
make explicit: (i) the process used to conduct impact determinations; (ii) assumptions related to
impact determinations; (iii) sources and methods for obtaining impact information; and (iv) the
rationale for conclusions reached with regard to impact determinations.
Organizations may explicitly define how established priorities and values guide the identification
of high-value assets and the potential adverse impacts to organizational stakeholders. If such
information is not defined, priorities and values related to identifying targets of threat sources and
associated organizational impacts can typically be derived from strategic planning and policies.
For example, security categorization levels indicate the organizational impacts of compromising
different types of information. Privacy Impact Assessments and criticality levels (when defined as
part of contingency planning or Mission/Business Impact Analysis) indicate the adverse impacts
of destruction, corruption, or loss of accountability for information resources to organizations.
28 The term organizational assets can have a very wide scope of applicability to include, for example, high-impact
programs, physical plant, mission-critical information systems, personnel, equipment, or a logically related group of
systems. More broadly, organizational assets represent any resource or set of resources which the organization values,
including intangible assets such as image or reputation.