Guide for Conducting Risk Assessments
CHAPTER 3 > 3.2 CONDUCTING THE RISK ASSESSMENT

3.2 CONDUCTING THE RISK ASSESSMENT

The second step in the risk assessment process is to conduct the assessment. The objective of this
step is to produce a list of information security risks that can be prioritized by risk level and used
to inform risk response decisions. To accomplish this objective, organizations analyze threats and
vulnerabilities, impacts and likelihood, and the uncertainty associated with the risk assessment
process. This step also includes the gathering of essential information as a part of each task and is
conducted in accordance with the assessment context established in the Prepare step of the risk
assessment process. The expectation for risk assessments is to adequately cover the entire threat
space in accordance with the specific definitions, guidance, and direction established during the
Prepare step. However, in practice, adequate coverage within available resources may dictate
generalizing threat sources, threat events, and vulnerabilities to ensure full coverage and assessing
specific, detailed sources, events, and vulnerabilities only as necessary to accomplish risk
assessment objectives. Conducting risk assessments includes the following specific tasks:
•
Identify threat sources that are relevant to organizations;
•
Identify threat events that could be produced by those sources;
•
Identify vulnerabilities within organizations that could be exploited by threat sources through
specific threat events and the predisposing conditions that could affect successful
exploitation;
•
Determine the likelihood that the identified threat sources would initiate specific threat events
and the likelihood that the threat events would be successful;
•
Determine the adverse impacts to organizational operations and assets, individuals, other
organizations, and the Nation resulting from the exploitation of vulnerabilities by threat
sources (through specific threat events); and
•
Determine information security risks as a combination of likelihood of threat exploitation of
vulnerabilities and the impact of such exploitation, including any uncertainties associated
with the risk determinations.
The specific tasks are presented in a sequential manner for clarity. However, in practice, some
iteration among the tasks is both necessary and expected.45 Depending on the purpose of the risk
assessment, organizations may find reordering the tasks advantageous.46 Whatever adjustments
organizations make to the tasks described below, risk assessments should meet the stated purpose,
scope, assumptions, and constraints established by the organizations initiating the assessments.
To assist organizations in executing the individual tasks in the risk assessment process, a set of
templates is provided in Appendices D through I. These appendices provide useful information
for organizations in assessing risk and can also be used to record assessment results produced
during essential calculations and analyses. The templates are exemplary and can be tailored by
organizations in accordance with specific organizational mission/business requirements. The use
of the templates is not required in order to conduct risk assessments.
45 For example, as vulnerabilities are identified, additional threat events might be identified by asking how the newly
identified vulnerabilities could be exploited. If organizations identify vulnerabilities first and then define threat events,
there may be some events that do not map cleanly to vulnerabilities but do map to predisposing conditions.
46 For example, the risk assessment could start with an identification of mission/business impacts at Tiers 1 and 2 using
common techniques such as Mission Impact Analyses, Business Impact Analyses, Mission/Business Thread Analyses,
or Business Continuity Analyses. The results of such analyses could enable risk assessors to focus attention on, and
perform more detailed analysis of, potential threats to critical information systems, databases, communications links, or
other assets.