Guide for Conducting Risk Assessments
CHAPTER 2

Aggregation
Organizations may use risk aggregation to roll up several discrete or lower-level risks into a more
general or higher-level risk. Organizations may also use risk aggregation to efficiently manage
the scope and scale of risk assessments involving multiple information systems and multiple
mission/business processes with specified relationships and dependencies among those systems
and processes. Risk aggregation, conducted primarily at Tiers 1 and 2 and occasionally at Tier 3,
assesses the overall risk to organizational operations, assets, and individuals given the set of
discrete risks. In general, for discrete risks (e.g., the risk associated with a single information
system supporting a well-defined mission/business process), the worst-case impact establishes an
upper bound for the overall risk to organizational operations, assets, and individuals.29 One issue
for risk aggregation is that this upper bound for risk may fail to apply. For example, it may be
advantageous for organizations to assess risk at the organization level when multiple risks
materialize concurrently or when the same risk materializes repeatedly over a period of time. In
such situations, there is the possibility that the amount of overall risk incurred is beyond the risk
capacity of the organization, and therefore the overall impact to organizational operations and
assets (i.e., mission/business impact) goes beyond that which was originally assessed for each
specific risk.
When aggregating risk, organizations consider the relationship among various discrete risks. For
example, there may be a cause and effect relationship in that if one risk materializes, another risk
is more or less likely to materialize. If there is a direct or inverse relationship among discrete
risks, then the risks can be coupled (in a qualitative sense) or correlated (in a quantitative sense)
either in a positive or negative manner. Risk coupling or correlation (i.e., finding relationships
among risks that increase or decrease the likelihood of any specific risk materializing) can be
done at Tiers 1, 2, or 3.
Uncertainty
Uncertainty is inherent in the evaluation of risk, due to such considerations as: (i) limitations on
the extent to which the future will resemble the past; (ii) imperfect or incomplete knowledge of
the threat (e.g., characteristics of adversaries including tactics, techniques, and procedures); (iii)
undiscovered vulnerabilities in technologies or products; and (iv) unrecognized dependencies,
which can lead to unforeseen impacts. Uncertainty about the value of specific risk factors can also
be due to the step in the RMF or phase in the system development life cycle at which a risk
assessment is performed. For example, at early phases in the system development life cycle, the
presence and effectiveness of security controls may be unknown, while at later phases in the life
cycle, the cost of evaluating control effectiveness may outweigh the benefits in terms of more
fully informed decision making. Finally, uncertainty can be due to incomplete knowledge of the
risks associated with other information systems, mission/ business processes, services, common
infrastructures, and/or organizations. The degree of uncertainty in risk assessment results, due to
these different reasons, can be communicated in the form of the results (e.g., by expressing results
qualitatively, by providing ranges of values rather than single values for identified risks, or by
using a visual representations of fuzzy regions rather than points).
29 Security categorizations conducted in accordance with FIPS Publication 199 provide examples of worst-case impact
analyses (using the high water mark concept). This type of impact analysis provides an upper bound for risk when
applied to discrete situations within organizations.