Guide for Conducting Risk Assessments
CHAPTER 2

In general, risks materialize as a result of a series of threat events, each of which takes advantage
of one or more vulnerabilities. Organizations define threat scenarios to describe how the events
caused by a threat source can contribute to or cause harm. Development of threat scenarios is
analytically useful, since some vulnerabilities may not be exposed to exploitation unless and until
other vulnerabilities have been exploited. Analysis that illuminates how a set of vulnerabilities,
taken together, could be exploited by one or more threat events is therefore more useful than the
analysis of individual vulnerabilities. In addition, a threat scenario tells a story, and hence is
useful for risk communication as well as for analysis.
In addition to vulnerabilities as described above, organizations also consider predisposing
conditions. A predisposing condition is a condition that exists within an organization, a mission
or business process, enterprise architecture, information system, or environment of operation,
which affects (i.e., increases or decreases) the likelihood that threat events, once initiated, result
in adverse impacts to organizational operations and assets, individuals, other organizations, or the
Nation.27 Predisposing conditions include, for example, the location of a facility in a hurricane- or
flood-prone region (increasing the likelihood of exposure to hurricanes or floods) or a stand-alone
information system with no external network connectivity (decreasing the likelihood of exposure
to a network-based cyber attack). Vulnerabilities resulting from predisposing conditions that
cannot be easily corrected could include, for example, gaps in contingency plans, use of outdated
technologies, or weaknesses/deficiencies in information system backup and failover mechanisms.
In all cases, these types of vulnerabilities create a predisposition toward threat events having
adverse impacts on organizations. Vulnerabilities (including those attributed to predisposing
conditions) are part of the overall security posture of organizational information systems and
environments of operation that can affect the likelihood of occurrence of a threat event.
Likelihood
The likelihood of occurrence is a weighted risk factor based on an analysis of the probability that
a given threat is capable of exploiting a given vulnerability (or set of vulnerabilities). The
likelihood risk factor combines an estimate of the likelihood that the threat event will be initiated
with an estimate of the likelihood of impact (i.e., the likelihood that the threat event results in
adverse impacts). For adversarial threats, an assessment of likelihood of occurrence is typically
based on: (i) adversary intent; (ii) adversary capability; and (iii) adversary targeting. For other
than adversarial threat events, the likelihood of occurrence is estimated using historical evidence,
empirical data, or other factors. Note that the likelihood that a threat event will be initiated or will
occur is assessed with respect to a specific time frame (e.g., the next six months, the next year, or
the period until a specified milestone is reached). If a threat event is almost certain to be initiated
or occur in the (specified or implicit) time frame, the risk assessment may take into consideration
the estimated frequency of the event. The likelihood of threat occurrence can also be based on the
state of the organization (including for example, its core mission/business processes, enterprise
architecture, information security architecture, information systems, and environments in which
those systems operate)-taking into consideration predisposing conditions and the presence and
effectiveness of deployed security controls to protect against unauthorized/undesirable behavior,
detect and limit damage, and/or maintain or restore mission/business capabilities. The likelihood
of impact addresses the probability (or possibility) that the threat event will result in an adverse
impact, regardless of the magnitude of harm that can be expected.
27 The concept of predisposing condition is also related to the term susceptibility or exposure. Organizations are not
susceptible to risk (or exposed to risk) if a threat cannot exploit a vulnerability to cause adverse impact. For example,
organizations that do not employ database management systems are not vulnerable to the threat of SQL injections and
therefore, are not susceptible to such risk.