Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 1-2: Identify the scope of the risk assessment in terms of organizational applicability, time frame

TASK 1-2: Identify the scope of the risk assessment in terms of organizational applicability, time frame

supported, and architectural/technology considerations.
Supplemental Guidance: The scope of the risk assessment determines what will be considered in the assessment. Risk
assessment scope affects the range of information available to make risk-based decisions and is determined by the
organizational official requesting the assessment and the risk management strategy. Establishing the scope of the risk
assessment helps organizations to determine: (i) what tiers are addressed in the assessment; (ii) what parts of
organizations are affected by the assessment and how they are affected; (iii) what decisions the assessment results
support; (iv) how long assessment results are relevant; and (v) what influences the need to update the assessment.
Establishing the scope of the risk assessment helps to determine the form and content of the risk assessment report, as
well as the information to be shared as a result of conducting the assessment. At Tier 3, the scope of a risk assessment
can depend on the authorization boundary for the information system. Appendix K provides an example of the type of
information that may be included in a risk assessment report or the preferred vehicle for risk communication.
Organizational Applicability
Organizational applicability describes which parts of the organization or suborganizations are affected by the risk
assessment and the risk-based decisions resulting from the assessment (including the parts of the organization or
suborganizations responsible for implementing the activities and tasks related to the decisions). For example, the risk
assessment can inform decisions regarding information systems supporting a particular organizational mission/business
function or mission/business process. This can include decisions regarding the selection, tailoring, or supplementation
of security controls for specific information systems or the selection of common controls. Alternatively, the risk
assessment can inform decisions regarding a set of closely related missions/business functions or mission/business
processes. The scope of the risk assessment can include not only the missions/business functions, mission/business
processes, common infrastructure, or shared services on which the organization currently depends, but also those which
the organization might use under specific operational conditions.
Effectiveness Time Frame
Organizations determine how long the results of particular risk assessments can be used to legitimately inform risk-
based decisions. The time frame is usually related to the purpose of the assessment. For example, a risk assessment to
inform Tier 1 policy-related decisions needs to be relevant for an extended period of time since the governance process
for policy changes can be time-consuming in many organizations. A risk assessment conducted to inform a Tier 3
decision on the use of a compensating security control for an information system may be relevant only until the next
release of the information technology product providing the required security capability. Organizations determine the
useful life of risk assessment results and under what conditions the current assessment results become ineffective or
irrelevant. Risk monitoring can be used to help determine the effectiveness of time frames for risk assessments. In
addition to risk assessment results, organizations also consider the currency/timeliness (i.e., latency or age) of all types
of information/data used in assessing risk. This is of particular concern in information reuse and evaluating the validity
of assessment results.
Architectural/Technology Considerations
Organizations use architectural and technology considerations to clarify the scope of the risk assessment. For example,
at Tier 3, the scope of the risk assessment can be an organizational information system in its environment of operations.
This entails placing the information system in its architectural context, so that vulnerabilities in inherited controls can
be taken into consideration. Alternately, the scope of the assessment can be limited solely to the information system,
without consideration of inherited vulnerabilities. At Tier 2, the scope of the risk assessment can be defined in terms of
the mission/business segment architecture (e.g., including all systems, services, and infrastructures that support a
specific mission/function). For a targeted risk assessment at any tier, the specific question to be answered can restrict
the scope to a specific technology.
IDENTIFY ASSUMPTIONS AND CONSTRAINTS