ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.12 INFORMATION SYSTEM SECURITY ENGINEER

D.12 INFORMATION SYSTEM SECURITY ENGINEER

The information system security engineer is an individual, group, or organization responsible for
conducting information system security engineering activities. Information system security
engineering is a process that captures and refines information security requirements and ensures
that the requirements are effectively integrated into information technology component products
and information systems through purposeful security architecting, design, development, and
configuration. Information system security engineers are an integral part of the development team
(e.g., integrated project team) designing and developing organizational information systems or
upgrading legacy systems. Information system security engineers employ best practices when
implementing security controls within an information system including software engineering
methodologies, system/security engineering principles, secure design, secure architecture, and
secure coding techniques. System security engineers coordinate their security-related activities
with information security architects, senior information security officers, information system
owners, common control providers, and information system security officers.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.13 SECURITY CONTROL ASSESSOR

D.13 SECURITY CONTROL ASSESSOR

The security control assessor is an individual, group, or organization responsible for conducting a
comprehensive assessment of the management, operational, and technical security controls
employed within or inherited by an information system to determine the overall effectiveness of
the controls (i.e., the extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to meeting the security requirements
for the system). Security control assessors also provide an assessment of the severity of
weaknesses or deficiencies discovered in the information system and its environment of operation
and recommend corrective actions to address identified vulnerabilities. In addition to the above
responsibilities, security control assessors prepare the final security assessment report containing
the results and findings from the assessment. Prior to initiating the security control assessment, an
assessor conducts an assessment of the security plan to help ensure that the plan provides a set of
security controls for the information system that meet the stated security requirements.
The required level of assessor independence is determined by the specific conditions of the
security control assessment. For example, when the assessment is conducted in support of an
authorization decision or ongoing authorization, the authorizing official makes an explicit
determination of the degree of independence required in accordance with federal policies,
directives, standards, and guidelines. Assessor independence is an important factor in: (i)
preserving the impartial and unbiased nature of the assessment process; (ii) determining the
credibility of the security assessment results; and (iii) ensuring that the authorizing official
receives the most objective information possible in order to make an informed, risk-based,
authorization decision. The information system owner and common control provider rely on the
security expertise and the technical judgment of the assessor to: (i) assess the security controls
employed within and inherited by the information system using assessment procedures specified
in the security assessment plan; and (ii) provide specific recommendations on how to correct
weaknesses or deficiencies in the controls and address identified vulnerabilities.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.2 RISK EXECUTIVE (FUNCTION)

D.2 RISK EXECUTIVE (FUNCTION)

The risk executive (function) is an individual or group within an organization that provides a more
comprehensive, organization-wide approach to risk management. The risk executive (function)
serves as the common risk management resource for senior leaders/executives, mission/business
66 The roles and responsibilities described in this appendix are consistent with the roles and responsibilities associated
with the Risk Management Framework in NIST Special Publication 800-37.
67 Organizations may define other roles (e.g., facilities manager, human resources manager, systems administrator) to
support the risk management process.
68 Caution is exercised when one individual fills multiples roles in the risk management process to ensure that the
individual retains an appropriate level of independence and remains free from conflicts of interest.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.3 CHIEF INFORMATION OFFICER

D.3 CHIEF INFORMATION OFFICER

The chief information officer69 is an organizational official responsible for: (i) designating a
senior information security officer; (ii) developing and maintaining information security policies,
procedures, and control techniques to address all applicable requirements; (iii) overseeing
personnel with significant responsibilities for information security and ensuring that the personnel
are adequately trained; (iv) assisting senior organizational officials concerning their security
responsibilities; and (v) in coordination with other senior officials, reporting annually to the head
of the federal agency on the overall effectiveness of the organization's information security
program, including progress of remedial actions. The chief information officer, with the support
of the risk executive (function) and the senior information security officer, works closely with
authorizing officials and their designated representatives to help ensure that:
• An organization-wide information security program is effectively implemented resulting in
adequate security for all organizational information systems and environments of operation
for those systems;
• Information security considerations are integrated into programming/planning/budgeting
cycles, enterprise architectures, and acquisition/system development life cycles;
• Information systems are covered by approved security plans and are authorized to operate;
• Information security-related activities required across the organization are accomplished in an
efficient, cost-effective, and timely manner; and
• There is centralized reporting of appropriate information security-related activities.
The chief information officer and authorizing officials also determine, based on organizational
priorities, the appropriate allocation of resources dedicated to the protection of the information
systems supporting the organization's missions and business functions. For selected information
systems, the chief information officer may be designated as an authorizing official or a co
authorizing official with other senior organizational officials. The role of chief information
officer has inherent U.S. Government authority and is assigned to government personnel only.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.4 INFORMATION OWNER/STEWARD

D.4 INFORMATION OWNER/STEWARD

The information owner/steward is an organizational official with statutory, management, or
operational authority for specified information and the responsibility for establishing the policies
and procedures governing its generation, collection, processing, dissemination, and disposal.70 In
information-sharing environments, the information owner/steward is responsible for establishing
the rules for appropriate use and protection of the subject information (e.g., rules of behavior) and
retains that responsibility when the information is shared with or provided to other organizations.
The owner/steward of the information processed, stored, or transmitted by an information system
69 When an organization has not designated a formal chief information officer position, FISMA requires the associated
responsibilities to be handled by a comparable organizational official.
70 Federal information is an asset of the Nation, not of a particular federal agency or its subordinate organizations. In
that spirit, many federal agencies are developing policies, procedures, processes, and training needed to end the practice
of information ownership and implement the practice of information stewardship. Information stewardship is the
careful and responsible management of federal information belonging to the Nation as a whole, regardless of the entity
or source that may have originated, created, or compiled the information. Information stewards provide maximum
access to federal information to elements of the federal government and its customers, balanced by the obligation to
protect the information in accordance with the provisions of FISMA and any associated security-related federal
policies, directives, regulations, standards, and guidance.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.5 SENIOR INFORMATION SECURITY OFFICER

D.5 SENIOR INFORMATION SECURITY OFFICER

The senior information security officer is an organizational official responsible for: (i) carrying
out the chief information officer security responsibilities under FISMA; and (ii) serving as the
primary liaison for the chief information officer to the organization's authorizing officials,
information system owners, common control providers, and information system security officers.
The senior information security officer: (i) possesses professional qualifications, including
training and experience, required to administer the information security program functions; (ii)
maintains information security duties as a primary responsibility; and (iii) heads an office with
the mission and resources to assist the organization in achieving more secure information and
information systems in accordance with the requirements in FISMA. The senior information
security officer (or supporting staff members) may also serve as authorizing official designated
representatives or security control assessors. The role of senior information security officer has
inherent U.S. Government authority and is assigned to government personnel only.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.6 AUTHORIZING OFFICIAL

D.6 AUTHORIZING OFFICIAL

The authorizing official is a senior official or executive with the authority to formally assume
responsibility for operating an information system at an acceptable level of risk to organizational
operations and assets, individuals, other organizations, and the Nation.71 Authorizing officials
typically have budgetary oversight for an information system or are responsible for the mission
and/or business operations supported by the system. Through the security authorization process,
authorizing officials are accountable for the security risks associated with information system
operations. Accordingly, authorizing officials are in management positions with a level of
authority commensurate with understanding and accepting such information system-related
security risks. Authorizing officials also approve security plans, memorandums of agreement or
understanding, and plans of action and milestones and determine whether significant changes in
the information systems or environments of operation require reauthorization. Authorizing
officials can deny authorization to operate an information system or if the system is operational,
halt operations, if unacceptable risks exist. Authorizing officials coordinate their activities with
the risk executive (function), chief information officer, senior information security officer,
common control providers, information system owners, information system security officers,
security control assessors, and other interested parties during the security authorization process.
With the increasing complexity of mission/business processes, partnership arrangements, and the
use of external/shared services, it is possible that a particular information system may involve
multiple authorizing officials. If so, agreements are established among the authorizing officials
and documented in the security plan. Authorizing officials are responsible for ensuring that all
activities and functions associated with security authorization that are delegated to authorizing
official designated representatives are carried out. The role of authorizing official has inherent
U.S. Government authority and is assigned to government personnel only.
71 The responsibility of authorizing officials described in FIPS 200, was extended in NIST Special Publication 800-53
to include risks to other organizations and the Nation.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.7 AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE

D.7 AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE

The authorizing official designated representative is an organizational official that acts on behalf
of an authorizing official to coordinate and conduct the required day-to-day activities associated
with the security authorization process. Authorizing official designated representatives can be
empowered by authorizing officials to make certain decisions with regard to the planning and
resourcing of the security authorization process, approval of the security plan, approval and
monitoring the implementation of plans of action and milestones, and the assessment and/or
determination of risk. The designated representative may also be called upon to prepare the final
authorization package, obtain the authorizing official's signature on the authorization decision
document, and transmit the authorization package to appropriate organizational officials. The
only activity that cannot be delegated to the designated representative by the authorizing official
is the authorization decision and signing of the associated authorization decision document (i.e.,
the acceptance of risk to organizational operations and assets, individuals, other organizations,
and the Nation).
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.8 COMMON CONTROL PROVIDER

D.8 COMMON CONTROL PROVIDER

The common control provider is an individual, group, or organization responsible for the
development, implementation, assessment, and monitoring of common controls (i.e., security
controls inherited by information systems).72 Common control providers are responsible for: (i)
documenting the organization-identified common controls in a security plan (or equivalent
document prescribed by the organization); (ii) ensuring that required assessments of common
controls are carried out by qualified assessors with an appropriate level of independence defined
by the organization; (iii) documenting assessment findings in a security assessment report; and
(iv) producing a plan of action and milestones for all controls having weaknesses or deficiencies.
Security plans, security assessment reports, and plans of action and milestones for common
controls (or a summary of such information) is made available to information system owners
inheriting those controls after the information is reviewed and approved by the senior official or
executive with oversight responsibility for those controls.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.9 INFORMATION SYSTEM OWNER

D.9 INFORMATION SYSTEM OWNER

The information system owner is an organizational official responsible for the procurement,
development, integration, modification, operation, maintenance, and disposal of an information
system.73 The information system owner is responsible for addressing the operational interests of
the user community (i.e., individuals who depend upon the information system to satisfy mission,
business, or operational requirements) and for ensuring compliance with information security
requirements. In coordination with the information system security officer, the information
system owner is responsible for the development and maintenance of the security plan and
ensures that the system is deployed and operated in accordance with the agreed-upon security
controls. In coordination with the information owner/steward, the information system owner is
72 Organizations can have multiple common control providers depending on how information security responsibilities
are allocated organization-wide. Common control providers may also be information system owners when the common
controls are resident within an information system.
73 The information system owner serves as the focal point for the information system. In that capacity, the information
system owner serves both as an owner and as the central point of contact between the authorization process and the
owners of components of the system including, for example: (i) applications, networking, servers, or workstations; (ii)
owners/stewards of information processed, stored, or transmitted by the system; and (iii) owners of the missions and
business functions supported by the system. Some organizations may refer to information system owners as program
managers or business/asset owners.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX F > GOVERNANCE MODELS > Decentralized Governance

Decentralized Governance

In decentralized information security governance structures, the authority, responsibility, and
decision-making power are vested in and delegated to individual subordinate organizations within
the parent organization (e.g., bureaus/components within an executive department of the federal
government or business units within a corporation). Subordinate organizations establish their own
policies, procedures, and processes for ensuring (sub) organization-wide involvement in the
development and implementation of risk management and information security strategies, risk
and information security decisions, and the creation of mechanisms to communicate within the
organization. A decentralized approach to information security governance accommodates
subordinate organizations with divergent mission/business needs and operating environments at
the cost of consistency throughout the organization as a whole. The effectiveness of this approach
is greatly increased by the sharing of risk-related information among subordinate organizations so
that no subordinate organization is able to transfer risk to another without the latter's informed
consent. It is also important to share risk-related information with parent organizations as the risk
decisions by subordinate organizations may have an effect on the organization as a whole.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX G > TRUST MODELS > Direct Historical Trust

Direct Historical Trust

In the direct historical trust model, the track record exhibited by an organization in the past,
particularly in its risk and information security-related activities and decisions, can contribute to
and help establish a level of trust with other organizations. While validated trust models assume
that an organization provides the required level of evidence needed to establish trust, obtaining
such evidence may not always be possible. In such instances, trust may be based on other
deciding factors, including the organization's historical relationship with the other organization or
its recent experience in working with the other organization. For example, if one organization has
worked with a second organization for years doing some activity and has not had any negative
experiences, the first organization may be willing to trust the second organization in working on
another activity, even though the organizations do not share any common experience for that
particular activity. Direct historical trust tends to build up over time with the more positive
experiences contributing to increased levels of trust between organizations. Conversely, negative
experiences may cause trust levels to decrease among organizations.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX F > GOVERNANCE MODELS

GOVERNANCE MODELS

APPROACHES TO INFORMATION SECURITY GOVERNANCE
T
hree approaches to information security governance can be used to meet organizational
needs: (i) a centralized approach; (ii) a decentralized approach; or (iii) a hybrid approach.
The authority, responsibility, and decision-making power related to information security
and risk management differ in each governance approach. The appropriate governance structure
for an organization varies based on many factors (e.g., mission/business needs; culture and size of
the organization; geographic distribution of organizational operations, assets, and individuals; and
risk tolerance). The information security governance structure is aligned with other governance
structures (e.g., information technology governance) to ensure compatibility with the established
management practices within the organization and to increase its overall effectiveness.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > H.1 OVERALL RISK RESPONSE STRATEGIES

H.1 OVERALL RISK RESPONSE STRATEGIES

Risk response strategies specify: (i) individuals or organizational subcomponents that are
responsible for the selected risk response measures and specifications of effectiveness criteria
(i.e., articulation of indicators and thresholds against which the effectiveness of risk response
measures can be judged); (ii) dependencies of the selected risk response measures on other risk
response measures; (iii) dependencies of selected risk response measures on other factors (e.g.,
implementation of other planned information technology measures); (iv) implementation timeline
for risk responses; (v) plans for monitoring the effectiveness of the risk response measures; (vi)
identification of risk monitoring triggers; and (vii) interim risk response measures selected for
implementation, if appropriate. Risk response implementation strategies may include interim
measures that organizations choose to implement. An overall risk response strategy provides an
organizational approach to selecting between the basic risk responses for a given risk situation. A
decision to accept risk must be consistent with the stated organizational tolerance for risk. Yet
79 There is overlap between the basic risk responses. For example, a shared risk is one that is being accepted by each
party in the sharing arrangement, and avoiding risk can be thought of as mitigating risk to zero. Nonetheless, with this
understanding of overlap, there is value in addressing each of the five types of risk responses separately.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H > H.2 RISK ACCEPTANCE STRATEGIES

H.2 RISK ACCEPTANCE STRATEGIES

Organizational risk acceptance strategies are essential companions to organizational statements
of risk tolerance. The objective of establishing an organizational risk tolerance is to state in clear
and unambiguous terms, a limit for risk-that is, how far organizations are willing to go with
regard to accepting risk to organizational operations (including missions, functions, image, and
reputation), organizational assets, individuals, other organizations, and the Nation. Real-world
operations, however, are seldom so simple as to make such risk tolerance statements the end-
statement for risk acceptance decisions. Organizational risk acceptance strategies place the
acceptance of risk into a framework of organizational perspectives on dealing with the practical
realities of operating with risk and provide the guidance necessary to ensure that the extent of the
risk being accepted in specific situations is compliant with organizational direction.