Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition > TASK 3-2: Evaluate alternative courses of action for responding to risk.

TASK 3-2: Evaluate alternative courses of action for responding to risk.

Supplemental Guidance: The evaluation of alternative courses of action can include: (i) the expected effectiveness in
achieving desired risk response (and how effectiveness is measured and monitored); and (ii) anticipated feasibility of
implementation, including, for example, mission/business impact, political, legal, social, financial, technical, and
economic considerations. Economic considerations include costs throughout the expected period of time during which
the course of action is followed (e.g., cost of procurement, integration into organizational processes at Tier 1 and/or
Tier 2, information systems at Tier 3, training, and maintenance). During the evaluation of alternative courses of action,
trade-offs can be made explicit between near-term gains in mission/business effectiveness or efficiency and long-term
risk of mission/business harm due to compromise of information or information systems that are providing this near-
term benefit. For example, organizations concerned about the potential for mobile devices (e.g., laptop computers)
being compromised while employees are on travel can evaluate several courses of action including: (i) providing users
traveling to high-risk areas with clean laptops; (ii) removing hard drives from laptops and operate from CDs or DVDs;
or (iii) having laptops go through a detailed assessment before being allowed to connect to organizational networks.
The first option is highly effective as returning laptops are never connected to organizational networks. While the
second option ensures that hard drives cannot be corrupted, it is not quite as effective in that it is still possible that
hardware devices (e.g., motherboards) could have been compromised. The effectiveness of the third option is limited
by the ability of organizations to detect potential insertion of malware into the hardware, firmware, or software. As
such, it is the least effective of the three options. From a cost perspective, the first option is potentially the most
expensive, depending upon the number of travelers (hence number of travel laptops) required. The second and third
options are considerably less expensive. From a mission and operational perspective, the third option is the best
alternative as users have access to standard laptop configurations including all applications and supporting data needed
to perform tasks supporting missions and business functions. Such applications and data would not be available if the
first or second option is selected. Ultimately, the evaluation of courses of action is made based on operational
requirements, including information security requirements, needed for near and long term mission/business success.
Budgetary constraints, consistency with investment management strategies, civil liberties, and privacy protection, are
some of the important elements organizations consider when selecting appropriate courses of action. In those instances
where organizations only identify a single course of action, then the evaluation is focused on whether the course of
action is adequate. If the course of action is deemed inadequate, then organizations need to refine the identified course
of action to address the inadequacies or develop another course of action (see Task 3-1).
In summary, a risk verses risk-response trade-off is conducted for each course of action to provide the information
necessary for: (i) selecting between the courses of action; and (ii) evaluating the courses of action in terms of response
effectiveness, costs, mission/business impact, and any other factors deemed relevant to organizations. Part of risk
versus risk-response trade-off considers the issue of competing resources. From an organizational perspective, this
means organizations consider whether the cost (e.g., money, personnel, time) for implementing a given course of action
has the potential to adversely impact other missions or business functions, and if so, to what extent. This is necessary
because organizations have finite resources to employ and many competing missions/business functions across many
organizational elements. Therefore, organizations assess the overall value of alternative courses of action with regard to
the missions/business functions and the potential risk to each organizational element. Organizations may determine that
irrespective of a particular mission/business function and the validity of the associated risk, there are more important
missions/business functions that face more significant risks, and hence have a better claim on the limited resources.
RISK RESPONSE DECISION