Managing Information Security Risk: Organization, Mission, and Information System View
Appendix G describes several trust models that can be applied in an organizational context, and > 2.6.2 Trustworthiness of Information Systems

2.6.2 Trustworthiness of Information Systems

The concept of trustworthiness can also be applied to information systems and the information
technology products and services that compose those systems. Trustworthiness expresses the
degree to which information systems (including the information technology products from which
the systems are built) can be expected to preserve the confidentiality, integrity, and availability of
the information being processed, stored, or transmitted by the systems across the full range of
threats. Trustworthy information systems are systems that have been determined to have the level
of trustworthiness necessary to operate within defined levels of risk despite the environmental
disruptions, human errors, and purposeful attacks that are expected to occur in their environments
of operation. Two factors affecting the trustworthiness of information systems are:
• Security functionality (i.e., the security features/functions employed within the system); and
• Security assurance (i.e., the grounds for confidence that the security functionality is effective
in its application).52
Security functionality can be obtained by employing within organizational information systems
and their environments of operation, a combination of management, operational, and technical
security controls from NIST Special Publication 800-53.53 The development and implementation
of needed security controls is guided by and informed by the enterprise architecture established
by organizations.
Security assurance is a critical aspect in determining the trustworthiness of information systems.
Assurance is the measure of confidence that the security features, practices, procedures, and
architecture of an information system accurately mediates and enforces the security policy.54
Assurance is obtained by: (i) the actions taken by developers and implementers55 with regard to
the design, development, implementation, and operation of the security functionality (i.e.,
security controls); and (ii) the actions taken by assessors to determine the extent to which the
functionality is implemented correctly, operating as intended, and producing the desired outcome
52 Assurance also represents the grounds for confidence that the intended functionality of an information system is
correct, always invoked (when needed), and resistant to bypass or tampering.
53 The employment of appropriate security controls for information systems and environments of operation is guided by
the first three steps in the Risk Management Framework (i.e., categorization, selection, and implementation).
54 A security policy is set of criteria for the provision of security services.
55 In this context, a developer/implementer is an individual or group of individuals responsible for the design,
development, implementation, or operation of security controls for an information system or supporting infrastructure.
with respect to meeting the security requirements for information systems and their environments
of operation.56 Developers and implementers can increase the assurance in security functionality
by employing well-defined security policies and policy models, structured and rigorous hardware
and software development techniques, and sound system/security engineering principles.
Assurance for information technology products and systems is commonly based on the
assessments conducted (and associated assessment evidence produced) during the initiation,
acquisition/development, implementation, and operations/maintenance phases of the system
development life cycle. For example, developmental evidence may include the techniques and
methods used to design and develop security functionality. Operational evidence may include
flaw reporting and remediation, the results of security incident reporting, and the results of
ongoing security control monitoring. Independent assessments by qualified assessors may include
analyses of the evidence as well as testing, inspections, and audits of the implementation of the
selected security functionality.57
The concepts of assurance and trustworthiness are closely related. Assurance contributes to the
trustworthiness determination relative to an information technology product or an information
system. Developers/implementers of information technology products or systems may provide
assurance evidence by generating appropriate artifacts (e.g., the results of independent testing and
evaluation, design documentation, high-level or low-level specifications, source code analysis).
Organizations using information technology products or systems may perform, or rely on others
to perform, some form of assessment on the products or systems. Organizations may also have
direct experience with the product or system, or may receive information about the performance
of the product or system from third parties. Organizations typically evaluate all of the available
assurance evidence, often applying different weighting factors as appropriate, to determine the
trustworthiness of the product or system relative to the circumstances.
Information technology products and systems exhibiting a higher degree of trustworthiness (i.e.,
products/systems having appropriate functionality and assurance) are expected to exhibit a lower
rate of latent design and implementation flaws and a higher degree of penetration resistance
against a range of threats including sophisticated cyber attacks, natural disasters, accidents, and
intentional/unintentional errors. The susceptibility of missions/business functions of organizations
to known threats, the environments of operation where information systems are deployed, and the
maximum acceptable level of risk to organizational operations and assets, individuals, other
organizations, or the Nation, guide the degree of trustworthiness needed.
Trustworthiness is a key factor in the selection and wise use of information technology products
used in organizational information systems. Insufficient attention to trustworthiness of information
technology products and systems can adversely affect an organization's capability to successfully
carry out its assigned missions/business functions.
56 For other than national security systems, organizations meet minimum assurance requirements specified in NIST
Special Publication 800-53, Appendix E.
57 NIST Special Publication 800-53A provides guidance on assessing security controls in federal information systems.