ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
CHAPTER 3

• Tables I-4 and I-6 provide descriptions of column headings for key data elements used in risk determinations for
adversarial and non-adversarial threat events, respectively; and
• Tables I-5 and I-7 provide templates for summarizing/documenting key data elements used in risk determinations
for adversarial and non-adversarial threat events, respectively.
The information produced in Task 2-6 provides risk inputs to the risk tables in Appendix I.
Summary of Key Activities - Task 2-6
•
Identify risk and uncertainty determination inputs (see Table I-1, as tailored by the
organization).
•
Determine risk (see Table I-2 and Table I-3, as tailored by the organization); update Column
13 in Table I-5 for adversarial risk and Column 11 in Table I-7 for non-adversarial risk.
Guide for Conducting Risk Assessments
Chapter Three); (ii) an explicit risk model, defining key terms and assessable risk factors and the

Chapter Three); (ii) an explicit risk model, defining key terms and assessable risk factors and the

relationships among the factors; (iii) an assessment approach (e.g., quantitative, qualitative, or
semi-qualitative), specifying the range of values those risk factors can assume during the risk
assessment and how combinations of risk factors are identified/analyzed so that values of those
Guide for Conducting Risk Assessments
describes: (i) the risk management process and how risk assessments are an

1.4 ORGANIZATION OF THIS SPECIAL PUBLICATION

The remainder of this special publication is organized as follows:
•

describes: (i) the risk management process and how risk assessments are an

integral part of that process; (ii) the basic terminology used in conducting risk assessments;
and (iii) how risk assessments can be applied across the organization's risk management tiers
(i.e., organization level, mission/business process level, and information system level).
•
Guide for Conducting Risk Assessments
APPENDIX K > RISK ASSESSMENT REPORTS > Executive Summary

Executive Summary

•
List the date of the risk assessment.
•
Summarize the purpose of the risk assessment.
•
Describe the scope of the risk assessment.
-
For Tier 1 and Tier 2 risk assessments, identify: organizational governance structures
or processes associated with the assessment (e.g., risk executive [function], budget
process, acquisition process, systems engineering process, enterprise architecture,
information security architecture, organizational missions/business functions,
mission/business processes, information systems supporting the mission/business
processes).
-
For Tier 3 risk assessments, identify: the information system name and location(s),
security categorization, and information system (i.e., authorization) boundary.
•
State whether this is an initial or subsequent risk assessment. If a subsequent risk
assessment, state the circumstances that prompted the update and include a reference to
the previous Risk Assessment Report.
•
Describe the overall level of risk (e.g., Very Low, Low, Moderate, High, or Very High).
•
List the number of risks identified for each level of risk (e.g., Very Low, Low, Moderate,
High, or Very High).
Guide for Conducting Risk Assessments
APPENDIX H > IMPACT

IMPACT

EFFECTS OF THREAT EVENTS ON ORGANIZATIONS, INDIVIDUALS, AND THE NATION
his appendix provides: (i) a description of useful inputs to the impact determination task;
(ii) representative examples of adverse impacts to organizational operations and assets,
individuals, other organizations, or the Nation; (iii) exemplary assessment scales for
assessing the impact of threat events and the range of effect of threat events; and (iv) a template
for summarizing and documenting the results of the impact determination Task 2-5. The
assessment scales in this appendix can be used as a starting point with appropriate tailoring to
adjust for any organization-specific conditions. Table H-4, an output from Task 2-5, provides
relevant inputs to the risk tables in Appendix I.
TABLE H-1: INPUTS - DETERMINATION OF IMPACT
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1 (Organization level)
- Impact information and guidance specific to Tier 1 (e.g., impact information related to organizational
governance, core missions/business functions, management and operational policies, procedures,
and structures, external mission/business relationships).
- Guidance on organization-wide levels of impact needing no further consideration.
- Identification of critical missions/business functions.
- Exemplary set of impacts, annotated by the organization, if necessary. (Table H-2)
- Assessment scale for assessing the impact of threat events, annotated by the organization, if
necessary. (Table H-3)
No
Yes
Yes
If not
provided
by Tier 2
From Tier 2: (Mission/business process level)
- Impact information and guidance specific to Tier 2 (e.g., impact information related to
mission/business processes, EA segments, common infrastructure, support services, common
controls, and external dependencies).
- Identification of high-value assets.
Yes
Via
RAR
Yes
Via
Peer
Sharing
Yes
From Tier 3: (Information system level)
- Impact information and guidance specific to Tier 3 (e.g., likelihood information affecting information
systems, information technologies, information system components, applications, networks,
environments of operation).
- Historical data on successful and unsuccessful cyber attacks; attack detection rates.
- Security assessment reports (i.e., deficiencies in assessed controls identified as vulnerabilities).
- Results of continuous monitoring activities (e.g., automated and nonautomated data feeds).
- Vulnerability assessments, Red Team reports, or other reports from analyses of information systems,
subsystems, information technology products, devices, networks, or applications.
- Contingency Plans, Disaster Recovery Plans, Incident Reports.
Yes
Via
RAR
Yes
Via
RAR
Yes
Via
Peer
Sharing
T
Guide for Conducting Risk Assessments
APPENDIX J > INFORMING RISK RESPONSE

INFORMING RISK RESPONSE

APPROACHES TO REFINING RISK ASSESSMENT RESULTS
risk assessment may identify a number of risks that have similar scores (e.g., 78, 82, 83)
or levels (e.g., moderate, high). When too many risks are clustered at or about the same
value, organizations need a method to refine the presentation of risk assessment results,
prioritizing within sets of risks with similar values, to better inform the risk response component
of the risk management process.56 Such a method should be associated with the mission/business
requirements of the organization, consistent with the organizational risk tolerance, and maximize
the use of available resources. Prioritization is a key component of risk-based protection and
becomes necessary when requirements cannot be fully satisfied or when resources do not allow
all risks to be mitigated within a reasonable time frame. To facilitate informed risk response
decisions by senior leaders/executives (e.g., why certain risks were or were not mitigated), the
risk assessment results are annotated to enable those decision makers to know or obtain the
answers to the following questions about each risk in a set with similar scores:
Time Frame
In the event the identified risk materialized-
•
How high would the immediate impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
•
How high would the future impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
The answers to the above questions, together with the risk tolerance of the organization, provide
the basis for a risk prioritization that is based on current and future organizational needs. When
weighing immediate impacts versus future impacts, senior leaders must decide whether a critical
mission/business need today warrants jeopardizing the future capabilities of the organization.
Mission/business owners and mission/business subject matter experts can be consulted to obtain
the most complete and up-to-date information on mission/business impacts. Other subject matter
experts or stakeholder representatives can be consulted to obtain information on immediate versus
future impacts (e.g., consulting the Privacy Office for impacts to individuals).
Total Cumulative Impact
•
What is the expected impact from a single occurrence of the threat?
•
If the risk can materialize more than once, what is the overall expected impact (i.e.,
cumulative loss) for the time period of concern?
Note that one aspect of the total impact to organizations is the cost of recovery from a loss of
confidentiality, integrity, or availability.
56 The risk executive (function) provides policy-level guidance on organizational risk tolerance and other factors that
inform and guide the risk-based decisions of authorizing officials. This guidance can also influence the prioritization of
risk responses including for example, mitigation activities.
A
Guide for Conducting Risk Assessments
CHAPTER ONE > INTRODUCTION

INTRODUCTION

THE NEED FOR RISK ASSESSMENTS TO SUPPORT ENTERPRISE-WIDE RISK MANAGEMENT
rganizations5 in the public and private sectors depend on information technology6 and
information systems7 to successfully carry out their missions and business functions.
Information systems can include very diverse entities ranging from office networks,
financial and personnel systems to very specialized systems (e.g., industrial/process control
systems, weapons systems, telecommunications systems, and environmental control systems).
Information systems are subject to serious threats that can have adverse effects on organizational
operations and assets, individuals, other organizations, and the Nation by exploiting both known
and unknown vulnerabilities to compromise the confidentiality, integrity, or availability of the
information being processed, stored, or transmitted by those systems. Threats to information
systems can include purposeful attacks, environmental disruptions, human/machine errors, and
structural failures, and can result in harm to the national and economic security interests of the
United States. Therefore, it is imperative that leaders and managers at all levels understand their
responsibilities and are held accountable for managing information security risk-that is, the risk
associated with the operation and use of information systems that support the missions and
business functions of their organizations.
Risk assessment is one of the fundamental components of an organizational risk management
process as described in NIST Special Publication 800-39. Risk assessments are used to identify,
estimate, and prioritize risk to organizational operations (i.e., mission, functions, image, and
reputation), organizational assets, individuals, other organizations, and the Nation, resulting from
the operation and use of information systems. The purpose of risk assessments is to inform
decision makers and support risk responses by identifying: (i) relevant threats to organizations or
threats directed through organizations against other organizations; (ii) vulnerabilities both internal
and external to organizations; (iii) impact (i.e., harm) to organizations that may occur given the
potential for threats exploiting vulnerabilities; and (iv) likelihood that harm will occur. The end
result is a determination of risk (i.e., typically a function of the degree of harm and likelihood of
harm occurring). Risk assessments can be conducted at all three tiers in the risk management
hierarchy-including Tier 1 (organization level), Tier 2 (mission/business process level), and Tier
Guide for Conducting Risk Assessments
APPENDIX A > REFERENCES

REFERENCES

LAWS, POLICIES, DIRECTIVES, INSTRUCTIONS, STANDARDS, AND GUIDELINES
LEGISLATION
1.
E-Government Act [includes FISMA] (P.L. 107-347), December 2002.
2.
Federal Information Security Management Act (P.L. 107-347, Title III), December 2002.
POLICIES, DIRECTIVES, INSTRUCTIONS
1.
Office of Management and Budget, Circular A-130, Appendix III, Transmittal
Memorandum #4, Management of Federal Information Resources, November 2000.
2.
Committee on National Security Systems Instruction (CNSSI) No. 4009, National
Information Assurance (IA) Glossary, April 2010.
3.
Committee on National Security Systems Instruction (CNSSI) No. 1253, Security
Categorization and Control Selection for National Security Systems, March 2012.
4.
Department of Homeland Security Federal Continuity Directive 2 (FCD 2), Federal
Executive Branch Mission Essential Function and Primary Mission Essential Function
Identification and Submission Process, February 2008.
STANDARDS
1.
Standards Publication 199, Standards for Security Categorization of Federal Information
and Information Systems, February 2004.
2.
Standards Publication 200, Minimum Security Requirements for Federal Information and
Information Systems, March 2006.
3.
ISO/IEC 31000:2009, Risk management - Principles and guidelines.
4.
ISO/IEC 30101:2009, Risk management - Risk assessment techniques.
5.
ISO/IEC Guide 73, Risk management - Vocabulary.
6.
ISO/IEC 27005:2011, Information technology - Security techniques - Information
security risk management.
GUIDELINES
1.
Guide for Developing Security Plans for Federal Information Systems, February 2006.
2.
Contingency Planning Guide for Federal Information Systems, May 2010.
3.
Guide for Applying the Risk Management Framework to Federal Information Systems: A
Security Life Cycle Approach, February 2010.
Guide for Conducting Risk Assessments
APPENDIX K > RISK ASSESSMENT REPORTS

RISK ASSESSMENT REPORTS

ESSENTIAL ELEMENTS OF INFORMATION
his appendix provides the essential elements of information that organizations can use to
communicate the results of risk assessments.57 Risk assessment results provide decision
makers with an understanding of the information security risk to organizational operations
and assets, individuals, other organizations, or the Nation that derive from the operation and use
of organizational information systems and the environments in which those systems operate. The
essential elements of information in a risk assessment can be described in three sections of the
risk assessment report (or whatever vehicle is chosen by organizations to convey the results of the
assessment): (i) an executive summary; (ii) the main body containing detailed risk assessment
results; and (iii) supporting appendices.
Guide for Conducting Risk Assessments
APPENDIX I > RISK DETERMINATION

RISK DETERMINATION

ASSESSING RISK TO ORGANIZATIONS, INDIVIDUALS, AND THE NATION
his appendix provides: (i) a description of potentially useful inputs to the risk
determination task including considerations for uncertainty of determinations; (ii)
exemplary assessment scales for assessing the levels of risk; (iii) tables for describing
content (i.e., data inputs) for adversarial and non-adversarial risk determinations; and (iv)
templates for summarizing and documenting the results of the risk determination Task 2-6. The
assessment scales in this appendix can be used as a starting point with appropriate tailoring to
adjust for any organization-specific conditions. Table I-5 (adversarial risk) and Table I-7 (non-
adversarial risk) are outputs from Task 2-6.
TABLE I-1: INPUTS - RISK
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1 (Organization level)
- Sources of risk and uncertainty information identified for organization-wide use (e.g., specific
information that may be useful in determining likelihoods such as adversary capabilities, intent, and
targeting objectives).
- Guidance on organization-wide levels of risk (including uncertainty) needing no further consideration.
- Criteria for uncertainty determinations.
- List of high-risk events from previous risk assessments.
- Assessment scale for assessing the level of risk as a combination of likelihood and impact, annotated
by the organization, if necessary. (Table I-2)
- Assessment scale for assessing level of risk, annotated by the organization, if necessary. (Table I-3)
No
Yes
Yes
If not
provided
by Tier 2
From Tier 2: (Mission/business process level)
- Risk-related information and guidance specific to Tier 2 (e.g., risk and uncertainty information related
to mission/business processes, EA segments, common infrastructure, support services, common
controls, and external dependencies).
Yes
Via
RAR
Yes
Via
Peer
Sharing
Yes
From Tier 3: (Information system level)
- Risk-related information and guidance specific to Tier 3 (e.g., likelihood information affecting
information systems, information technologies, information system components, applications,
networks, environments of operation).
Yes
Via
RAR
Yes
Via
RAR
Yes
Via
Peer
Sharing
TABLE I-2: ASSESSMENT SCALE - LEVEL OF RISK (COMBINATION OF LIKELIHOOD AND IMPACT)
Likelihood
(Threat Event Occurs
and Results in
Adverse Impact)
Level of Impact
Very Low
Low
Moderate
High
Very High
Very High
Very Low
Low
Moderate
High
Very High
High
Very Low
Low
Moderate
High
Very High
Moderate
Very Low
Low
Moderate
Moderate
High
Low
Very Low
Low
Low
Low
Moderate
Very Low
Very Low
Very Low
Very Low
Low
Low
T
Guide for Conducting Risk Assessments
Section 2.3.1) and identify which model is to be used for the risk assessment. To facilitate reciprocity of assessment

Section 2.3.1) and identify which model is to be used for the risk assessment. To facilitate reciprocity of assessment

results, organization-specific risk models include, or can be translated into, the risk factors (i.e., threat, vulnerability,
impact, likelihood, and predisposing condition) defined in the appendices. Organizations also identify the specific
analytic approach to be used for the risk assessment including the assessment approach (i.e., quantitative, qualitative,
semi-quantitative) and the analysis approach (i.e., threat-oriented, asset/impact-oriented, vulnerability-oriented). For
each assessable risk factor, the appendices include three assessment scales (one qualitative and two semi-quantitative
scales) with correspondingly different representations. Organizations typically define (or select and tailor from the
appendices) the assessment scales to be used in their risk assessments, annotating with organizationally-meaningful
examples for specific values and defining break points between bins for semi-quantitative approaches. In addition,
mission/business owners can provide further annotations with mission/business-specific examples. Organizations can
identify different assessment scales to be used in different circumstances. For example, for low-impact information
systems, organizations could use qualitative values, while for moderate- and high-impact systems, the most granular
semi-quantitative values (0-100) could be used. As discussed in Special Publication 800-39, Task 1-1, Risk
Assumptions, organizations vary in the relative weights applied to risk factors. Therefore, this guideline does not
specify algorithms for combining semi-quantitative values. Organization-specific risk models include algorithms (e.g.,
formulas, tables, rules) for combining risk factors. If an organization-specific risk model is not provided in the risk
management strategy as part of the risk framing step, then part of this task is to specify the algorithms for combining
values. Algorithms for combining risk factors reflect organizational risk tolerance (see the supplemental guidance to
Guide for Conducting Risk Assessments
Section 3.2, Appendix D

SUMMARY OF TASKS

RISK ASSESSMENT TASKS AND ASSOCIATED RISK TABLES
TABLE L-1: SUMMARY OF RISK ASSESSMENT TASKS
TASK

TASK DESCRIPTION

Step 1: Prepare for Risk Assessment

Section 3.1

Identify the purpose of the risk assessment in terms of the information that the
assessment is intended to produce and the decisions the assessment is intended to
support.

Section 3.1

Identify the scope of the risk assessment in terms of organizational applicability, time
frame supported, and architectural/technology considerations.

TASK 1-3

IDENTIFY ASSUMPTIONS
AND CONSTRAINTS

Section 3.1

Identify the specific assumptions and constraints under which the risk assessment is
conducted.

Section 3.1

Identify the sources of descriptive, threat, vulnerability, and impact information to be
used in the risk assessment.

TASK 1-5

IDENTIFY RISK MODEL AND
ANALYTIC APPROACH

Section 3.1

Identify the risk model and analytic approach to be used in the risk assessment.
Step 2: Conduct Risk Assessment

Section 3.2, Appendix D

Identify and characterize threat sources of concern, including capability, intent, and
targeting characteristics for adversarial threats and range of effects for non-adversarial
threats.
Guide for Conducting Risk Assessments
Section 3.2, Appendix G

Section 3.2, Appendix E

Identify potential threat events, relevance of the events, and the threat sources that could
initiate the events.

TASK 2-3

IDENTIFY VULNERABILITIES AND
PREDISPOSING CONDITIONS

Section 3.2, Appendix F

Identify vulnerabilities and predisposing conditions that affect the likelihood that threat
events of concern result in adverse impacts.

Section 3.2, Appendix G

Determine the likelihood that threat events of concern result in adverse impacts,
considering: (i) the characteristics of the threat sources that could initiate the events; (ii)
the vulnerabilities/predisposing conditions identified; and (iii) the organizational
susceptibility reflecting the safeguards/countermeasures planned or implemented to
impede such events.
Guide for Conducting Risk Assessments
Section 3.2, Appendix H

Section 3.2, Appendix H

Determine the adverse impacts from threat events of concern, considering: (i) the
characteristics of the threat sources that could initiate the events; (ii) the
vulnerabilities/predisposing conditions identified; and (iii) the organizational susceptibility
reflecting the safeguards/countermeasures planned or implemented to impede such
events.
Guide for Conducting Risk Assessments
Section 3.2, Appendix I

Section 3.2, Appendix I

Determine the risk to the organization from threat events of concern considering: (i) the
impact that would result from the events; and (ii) the likelihood of the events occurring.
Step 3: Communicate and Share Risk Assessment Results
Guide for Conducting Risk Assessments
CHAPTER 3 > Task 1-3) and performing a cataloging of specific vulnerabilities as necessary to do so. Organizations determine which

Task 1-3) and performing a cataloging of specific vulnerabilities as necessary to do so. Organizations determine which

vulnerabilities are relevant to which threat events in order to reduce the space of potential risks to be assessed. In
addition to identifying vulnerabilities, organizations also identify any predisposing conditions which may affect
susceptibility to certain vulnerabilities. Predisposing conditions that exist within organizations (including
mission/business processes, information systems, and environments of operation) can contribute to (i.e., increase or
decrease) the likelihood that one or more threat events, once initiated by threat sources, result in adverse impacts to
organizational operations, organizational assets, individuals, other organizations, or the Nation. Organizations
determine which predisposing conditions are relevant to which threat events in order to reduce the space of potential
risks to be assessed. Organizations assess the pervasiveness of predisposing conditions to support determination of the
tier(s) at which risk response could be most effective.