Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.1 FRAMING RISK > TASK 1-1: Identify assumptions that affect how risk is assessed, responded to, and monitored within the (part 2)

Organizations identify the degree of specificity with which
vulnerabilities are described (e.g., general terms, Common Vulnerability Enumeration [CVE] identifiers, identification
of weak/deficient security controls), giving some representative examples corresponding to representative threats. Organizational governance structures and processes determine how vulnerability information is shared across
organizations. Organizations may also identify sources of vulnerability information found to be credible and useful. At
Tier 2, mission/business owners may choose to identify additional sources of vulnerability information (e.g., a sector
ISAC for information about vulnerabilities specific to that sector). At Tier 3, program managers, information system
owners, and common control providers consider the phase in the system development life cycle-and in particular, the
technologies included in the system - to determine the level of detail with which vulnerabilities can be considered. Organizations make explicit any assumptions about the degree of organizational or information system vulnerability to
specific threat sources (by name or by type). Consequences and Impact
Organizations provide guidance on how to assess impacts to organizational operations (i.e., mission, functions, image,
and reputation), organizational assets, individuals, other organizations, and the Nation (e.g., using FIPS 199, CNSS
Instruction 1253, or a more granular approach). Organizations can experience the consequences/impact of adverse
events at the information system level (e.g., failing to perform as required), at the mission/business process level (e.g.,
failing to fully meet mission/business objectives), and at the organizational level (e.g., failing to comply with legal or
regulatory requirements, damaging reputation or relationships, or undermining long-term viability). Organizations
determine at Tier 1, which consequences and types of impact are to be considered at Tier 2, the mission/business
process level. An adverse event can have multiple consequences and different types of impact, at different levels, and
in different time frames. For example, the exposure of sensitive information (e.g., personally identifiable information)
by a particular mission/business area (e.g., human resources) can have organization-wide consequences and adverse
impact with regard to reputation damage; the information system consequence/impact for multiple systems of an
attacker more easily overcoming identification and authentication security controls; and the mission/business process
consequence/impact (for one or more mission/business areas) of an attacker falsifying information on which future
decisions are based. To ensure consistency, organizations determine at Tier 1, how consequences/impacts experienced
in different time frames are to be assessed. At Tier 2, mission/business owners may amplify organizational guidance, as
appropriate. The types of consequences and impact considered in risk determinations are identified to provide a basis
for determining, aggregating, and/or consolidating risk results and to facilitate risk communication. Organizations also
provide guidance to Tier 2 and Tier 3 with regard to the extent that risk assessments are to consider the risk to other
organizations and the Nation. Organization make explicit any assumptions about the degree of impact/consequences
related to specific threat sources (by name or by type) or through specific vulnerabilities (individually or by type). Likelihood
Organizations can employ a variety of approaches for determining the likelihood of threat events. Some organizations
treat the likelihood that a threat event will occur and the likelihood that, if it occurs, it will result in adverse effects as
separate factors, while other organizations assess threat likelihood as a combination of these factors. In addition, some
organizations prefer quantitative risk assessments while other organizations, particularly when the assessment involves
a high degree of uncertainty, prefer qualitative risk assessments. Likelihood determinations can be based on either
threat assumptions or actual threat data (e.g., historical data on cyber attacks, historical data on earthquakes, or specific
information on adversary capabilities, intentions, and targeting). When specific and credible threat data is available
(e.g., types of cyber attacks, cyber attack trends, frequencies of attacks), organizations can use the empirical data and
statistical analyses to determine more specific probabilities of threat events occurring. Organizations select a method
consistent with organizational culture and risk tolerance. Organizations can also make explicit assumptions concerning
the likelihood that a threat event will result in adverse effects as follows: (i) worst case (i.e., attack will be successful
unless strong, objective reasons to presume otherwise); (ii) best case (i.e., attack will not be successful unless specific,
credible information to the contrary); or (iii) something in between best and worst cases (e.g., the most probable case). Organizations document any overarching assumptions. Organizations can use empirical data and statistical analyses to
help inform any of the approaches used to determine the likelihood of threat events occurring. Organizations select a
method consistent with organizational culture, understanding of the operational environment, and risk tolerance. RISK CONSTRAINTS