Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.3 TIER ONE—ORGANIZATION VIEW > 2.3.3 Risk Management Strategy

2.3.3 Risk Management Strategy

An organizational risk management strategy, one of the key outputs of risk framing, addresses
how organizations intend to assess, respond to, and monitor risk-the risk associated with the
operation and use of organizational information systems. The risk management strategy makes
explicit the specific assumptions, constraints, risk tolerances, and priorities/trade-offs used within
organizations for making investment and operational decisions. The risk management strategy
also includes any strategic-level decisions and considerations on how senior leaders/executives
are to manage information security risk to organizational operations and assets, individuals, other
organizations, and the Nation. An organization-wide risk management strategy includes, for
example, an unambiguous expression of the risk tolerance for the organization, acceptable risk
assessment methodologies, risk response strategies, a process for consistently evaluating risk
across the organization with respect to the organization's risk tolerance, and approaches for
monitoring risk over time. The use of a risk executive (function) can facilitate consistent,
organization-wide application of the risk management strategy. The organization-wide risk
management strategy can be informed by risk-related inputs from other sources both internal and
external to the organization to ensure the strategy is both broad-based and comprehensive.
An important Tier 1 risk management activity and also part of risk framing, is the determination
of risk tolerance. Risk tolerance is the level of risk or degree of uncertainty that is acceptable to
organizations and is a key element of the organizational risk frame. Risk tolerance affects all
components of the risk management process-having a direct impact on the risk management
decisions made by senior leaders/executives throughout the organization and providing important
constraints on those decisions. For example, risk tolerance affects the nature and extent of risk
management oversight implemented in organizations, the extent and rigor of risk assessments
performed, and the content of organizational strategies for responding to risk. With regard to risk
assessments, more risk-tolerant organizations may be concerned only with those threats that peer
organizations have experienced while less risk-tolerant organizations may expand the list to
include those threats that are theoretically possible, but which have not been observed in
operational environments. With regard to risk response, less risk-tolerant organizations are likely
29 Organizations emphasize the need for inclusiveness within the risk executive (function) by senior leaders/executives
in mission/business areas to help ensure proper information security planning, resourcing, and risk management.
to require additional grounds for confidence in the effectiveness of selected safeguards and
countermeasures or prefer safeguards and countermeasures that are more mature and have a
proven track record. Such organizations may also decide to employ multiple safeguards and
countermeasures from multiple sources (e.g., antivirus software at clients and servers that are
provided by different vendors). Another example illustrating the impact of risk tolerance on risk
response is that risk tolerance can also affect the organizational requirements for trustworthiness
provided by specific information technologies. Two organizations may choose the same
information technologies, but their relative degree of risk tolerance may impact the degree of
assessment required prior to deployment.
There is no correct level of organizational risk tolerance. Rather, the degree of risk tolerance is:
(i) generally indicative of organizational culture; (ii) potentially different for different types of
losses/compromises; and (iii) highly influenced by the individual subjective risk tolerance of
senior leaders/executives. Yet, the ramifications of risk decisions based on risk tolerance are
potentially profound, with less risk-tolerant organizations perhaps failing to achieve needed
mission/business capabilities in order to avoid what appears to be unacceptable risk; while more
risk-tolerant organizations may focus on near-term mission/business efficiencies at the expense of
setting themselves up for future failure. It is important that organizations exercise due diligence in
determining risk tolerance-recognizing how fundamental this decision is to the effectiveness of
the risk management program.