Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.6.1 Establishing Trust Among Organizations

2.6.1 Establishing Trust Among Organizations

Parties enter into trust relationships based on mission and business needs.49 Trust among parties
typically exists along a continuum with varying degrees of trust achieved based on a number of
factors. Organizations can still share information and obtain information technology services even
if their trust relationship falls short of complete trust. The degree of trust required for
organizations to establish partnerships can vary widely based on many factors including the
organizations involved and the specifics of the situation (e.g., the missions, goals, and objectives
of the potential partners, the criticality/sensitivity of activities involved in the partnership, the risk
tolerance of the organizations participating in the partnership, and the historical relationship
among the participants). Finally, the degree of trust among entities is not a static quality but can
vary over time as circumstances change.
47 Transparency is achieved by providing visibility into the risk management and information security activities carried
out by organizations participating in partnerships (e.g., employing common security standards, specification language
for security controls including common controls, assessment procedures, risk assessment methodologies; defining
common artifacts and bodies of evidence used in making risk-related decisions).
48 Current state-of-the-practice for measuring trustworthiness can reliably differentiate between widely different levels
of trustworthiness and is capable of producing a trustworthiness scale that is hierarchical between similar instances of
measuring activities (e.g., the results from ISO/IEC 15408 [Common Criteria] evaluations).
49 Trust relationships can be: (i) formally established, for example, by documenting the trust-related information in
contracts, service-level agreements, statements of work, memoranda of agreement/understanding, or interconnection
security agreements; (ii) scalable and inter-organizational or intra-organizational in nature; and/or (iii) represented by
simple (bilateral) relationships between two partners or more complex many-to many relationships among many
diverse partners.
Organizations are becoming increasingly reliant on information system services50 and information
provided by external organizations as well as partnerships to accomplish missions and business
functions. This reliance results in the need for trust relationships among organizations.51 In many
cases, trust relationships with external organizations, while generating greater productivity and
cost efficiencies, can also bring greater risk to organizations. This risk is addressed by the risk
management strategies established by organizations that take into account the strategic goals and
objectives of organizations.
Effectively addressing the risk associated with the growing dependence on external service
providers and partnerships with domestic and international public and private sector participants
necessitates that organizations:
• Define the types of services/information to be provided to organizations or the types of
information to be shared/exchanged in any proposed partnering arrangements;
• Establish the degree of control or influence organizations have over the external
organizations participating in such partnering arrangements;
• Describe how the services/information are to be protected in accordance with the information
security requirements of organizations;
• Obtain the relevant information from external organizations to determine trustworthiness and
to support and maintain trust (e.g., visibility into business practices and risk/information
security decisions to understand risk tolerance);
• Appropriately balance mission/business-based requirements to support information sharing
while considering the risk of working with competing or hostile entities and the risk that other
organizations, while neither competing or hostile, may be a path through which such entities
attack;
• Determine if the ongoing risk to organizational operations and assets, individuals, other
organizations, or the Nation resulting from the continuing use of the services/information or
the participation in the partnership, is at an acceptable level; and
• Recognize that decisions to establish trust relationships are expressions of acceptable risk.
The degree of trust that an organization places in external organizations can vary widely, ranging
from those who are highly trusted (e.g., business partners in a joint venture that share a common
business model and common goals) to those who are less trusted and may represent greater
sources of risk (e.g., business partners in one endeavor who are also competitors or adversaries).
The specifics of establishing and maintaining trust can differ from organization to organization
based on mission/business requirements, the participants involved in the trust relationship, the
criticality/sensitivity of the information being shared or the types of services being rendered, the
history between the organizations, and the overall risk to the organizations participating in the
relationship. Appendix G provides several trust models that organizations can use when dealing
with external organizations.
In many situations, the trust established between organizations may not allow a full spectrum of
information sharing or a complete provision of services. When an organization determines that
50 External information system services are services that are implemented outside of the system's traditional
authorization boundary (i.e., services that are used by, but not a part of, the organizational information system).
51 External providers or mission/business partners can be public or private sector entities, domestic or international.
the trustworthiness of another organization does not permit the complete sharing of information
or use of external services, the organization can: (i) mitigate risk, transfer risk, or share risk by
employing one or more compensating controls; (ii) accept a greater degree of risk; or (iii) avoid
risk by performing missions/business functions with reduced levels of functionality or possibly
no functionality at all.
Explicit understanding and acceptance of the risk to an organization's operations and assets,
individuals, other organizations, and the Nation by senior leaders/executives (reflecting the
organization's risk tolerance) are made in accordance with the organization's risk management
strategy and a prerequisite for establishing trust relationships among organizations.