Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.5 TIER THREE—INFORMATION SYSTEMS VIEW (part 1)

2.5 TIER THREE-INFORMATION SYSTEMS VIEW

2.5 TIER THREE-INFORMATION SYSTEMS VIEW

All information systems, including operational systems, systems under development, and systems
undergoing modification, are in some phase of the system development life cycle.42 In addition to
the risk management activities carried out at Tier 1 and Tier 2 (e.g., reflecting the organization's
risk management strategy within the enterprise architecture and embedded information security
architecture), risk management activities are also integrated into the system development life
cycle of organizational information systems at Tier 3. The risk management activities at Tier 3
reflect the organization's risk management strategy and any risk related to the cost, schedule, and
performance requirements for individual information systems supporting the mission/business
functions of organizations. Risk management activities take place at every phase in the system
development life cycle with the outputs at each phase having an effect on subsequent phases. 40 The activities required to effectively incorporate information security into enterprise architecture are carried out by
key stakeholders within organizations including mission/business owners, chief information officers, chief information
security officers, authorizing officials, and the risk executive (function). 41 A management process is a process for planning and controlling the performance or execution of organizational
activities (e.g., programs, projects, tasks, processes). Management processes are often referred to as performance
measurement and management systems. 42 There are typically five phases in system development life cycles: (i) initiation; (ii) development/ acquisition; (iii)
implementation; (iv) operation/maintenance; and (v) disposal. Organizations may use a variety of system development
life cycle processes including, for example, waterfall, spiral, or agile development. For example, requirements definition43 is a critical part of any system development process and
begins very early in the life cycle, typically in the initiation phase. The latest threat information
that is available to organizations, or current organizational assumptions concerning threat, may
significantly influence information system requirements and the types of solutions that are
deemed by organizations to be acceptable (from a technological and operational perspective) in
the face of such threats. Information security requirements are a subset of the functional
requirements levied on information systems and are incorporated into the system development
life cycle simultaneously with the other requirements. The information security requirements
define the needed security functionality44 for information systems and the level of trustworthiness
for that functionality (see Section 2.6 on the trustworthiness of information systems). Organizations also address risk management issues during the development/acquisition phase of
the system development life cycle (e.g., system design, system development/integration, and
demonstration). Whether in response to specific and credible threat information or assumptions
about the threat, potential design-related vulnerabilities in organizational information systems can
be mitigated during this phase by choosing less susceptible alternatives. Supply chain risk during
the acquisition phase of the information system is also an area of concern for organizations. To
address supply chain risk during the development/acquisition phase, organizations implement
specific security controls as deemed necessary by the organization. Organizations also consider
risk from the standpoint of the environment in which the information systems are intended to
operate when selecting the most appropriate security controls. To be effective, controls must be
mutually supporting, employed with realistic expectations for effectiveness, and implemented as
part of an explicit, information system-level security architecture that is consistent with the
security architecture embedded in the organization's enterprise architecture. For example, when
certain technical controls are less than effective due to achievable levels of trustworthiness in
organizational information systems, management and operational controls are employed as
compensating controls-thus providing another opportunity to manage risk. Subsequent to initiation, development, and acquisition, the implementation phase of the system
development life cycle provides an opportunity for the organization to determine the effectiveness
of the selected security controls employed within or inherited by the information systems under
development prior to the commencement of actual operations. Expectations generated during this
phase can be compared with actual behavior as information systems are implemented. Given the
current threat information that is available to organizations and organizational assumptions about
the threat, the information discovered during effectiveness assessments, and the potential adverse
impacts on organizational missions/business functions, it may be necessary to modify or change
the planned implementation of the information system. Risk-related information can be developed
to justify the proposed changes. Once approved for operation, information systems move into the operations/maintenance phase
of the system development life cycle. The monitoring of security control effectiveness and any
changes to organizational information systems and the environments in which those systems
operate ensure that selected risk response measures are operating as intended on an ongoing basis. Ongoing monitoring is paramount to maintaining situational awareness of risk to organizational
missions and business functions-an awareness that is critical to making the necessary course
43 Information security requirements can be obtained from a variety of sources (e.g., legislation, policies, directives,
regulations, standards, and organizational mission/business/operational requirements).