Guide for Conducting Risk Assessments
APPENDIX D > THREAT SOURCES

CNSS

Committee on National Security Systems

COOP

Continuity of Operations
DoD
Department of Defense

FIPS

Federal Information Processing Standards

FISMA

Federal Information Security Management Act

IEC

International Electrotechnical Commission

ISO

International Organization for Standardization

NOFORN

Not Releasable to Foreign Nationals

ODNI

Office of the Director of National Intelligence

SCAP

Security Content Automation Protocol

TTP

Tactic Technique Procedure
U.S.C.
United States Code

THREAT SOURCES

TAXONOMY OF THREATS SOURCES CAPABLE OF INITIATING THREAT EVENTS
his appendix provides: (i) a description of potentially useful inputs to the threat source
identification task; (ii) an exemplary taxonomy of threat sources by type, description, and
risk factors (i.e., characteristics) used to assess the likelihood and/or impact of such threat
sources initiating threat events; (iii) an exemplary set of tailorable assessment scales for assessing
those risk factors; and (iv) templates for summarizing and documenting the results of the threat
source identification Task 2-1. The taxonomy and assessment scales in this appendix can be used
by organizations as a starting point with appropriate tailoring to adjust for organization-specific
conditions. Tables D-7 and D-8, outputs from Task 2-1, provide relevant inputs to the risk tables
in Appendix I.
TABLE D-1: INPUTS - THREAT SOURCE IDENTIFICATION
Description
Provided To
Tier 1
Tier 2
Tier 3
From Tier 1: (Organization level)
- Sources of threat information deemed to be credible (e.g., open source and/or classified threat
reports, previous risk/threat assessments). (Section 3.1, Task 1-4)
- Threat source information and guidance specific to Tier 1 (e.g., threats related to organizational
governance, core missions/business functions, management/operational policies, procedures, and
structures, external mission/business relationships).
- Taxonomy of threat sources, annotated by the organization, if necessary. (Table D-2)
- Characterization of adversarial and non-adversarial threat sources.
- Assessment scales for assessing adversary capability, intent, and targeting, annotated by the
organization, if necessary. (Table D-3, Table D-4, Table D-5)
- Assessment scale for assessing the range of effects, annotated by the organization, if necessary.
(Table D-6)
- Threat sources identified in previous risk assessments, if appropriate.
No
Yes
Yes
if not
provided by
Tier 2
From Tier 2: (Mission/business process level)
- Threat source information and guidance specific to Tier 2 (e.g., threats related to mission/business
processes, EA segments, common infrastructure, support services, common controls, and external
dependencies).
- Mission/business process-specific characterization of adversarial and non-adversarial threat
sources.
Yes
via
RAR
Yes
via
peer
sharing
Yes
From Tier 3: (Information system level)
- Threat source information and guidance specific to Tier 3 (e.g., threats related to information
systems, information technologies, information system components, applications, networks,
environments of operation).
- Information system-specific characterization of adversarial and non-adversarial threat sources.
Yes
via
RAR
Yes
via
RAR
Yes
via
peer
sharing
T