Guide for Conducting Risk Assessments
CHAPTER 2

RMF Step 3 - Implement
Organizations can use risk assessment results to identify alternative implementations of selected
security controls (e.g., considering vulnerabilities inherent in one security control implementation
versus another). Some information technology products, system components, or architectural
configurations may be more susceptible to certain types of threat sources; these susceptibilities
are subsequently addressed during security control development and implementation. In addition,
the strength of security mechanisms selected for implementation can take into consideration the
threat data from risk assessments. Individual configuration settings for information technology
products and system components can eliminate vulnerabilities identified during the analysis of
threat events. Risk assessment results also help inform decisions regarding the cost, benefit, and
risk trade-offs in using one type of technology versus another or how security controls are
effectively implemented in particular operational environments (e.g., when compensating controls
must be used due to the unavailability of certain technologies). As risk assessments are updated
and refined, organizations use the results to help determine if current security control
implementations remain effective given changes to the threat space.
RMF Step 4 - Assess
Organizations can use the results from security control assessments to inform risk assessments.
Security control assessments (documented in security assessment reports) identify vulnerabilities
in organizational information systems and the environments in which those systems operate.
Partial or complete failure of deployed security controls or the absence of planned controls
represents potential vulnerabilities that can be exploited by threat sources. Organizations use the
results from risk assessments to help determine the severity of such vulnerabilities which in turn,
can guide and inform organizational risk responses (e.g., prioritizing risk response activities,
establishing milestones for corrective actions).
RMF Step 5 - Authorize
Organizations can use risk assessment results to provide risk-related information to authorizing
officials. The risk responses carried out by organizations based on the risk assessments result in a
known security posture of organizational information systems and environments of operation.
Risk assessment results provide essential information to enable authorizing officials to make risk-
based decisions on whether to operate those systems in the current security posture or take actions
to provide additional security controls, thereby further reducing risk to organizational operations
and assets, individuals, other organizations, or the Nation.
RMF Step 6 - Monitor
Organizations can update risk assessments on an ongoing basis using security-related information
from organizational continuous monitoring processes.41 Continuous monitoring processes
evaluate: (i) the effectiveness of security controls; (ii) changes to information systems and
environments of operation; and (iii) compliance to federal legislation, regulations, directives,
policies, standards, and guidance. As risk assessments are updated and refined, organizations use
the results to update the risk management strategy, thereby incorporating lessons learned into risk
management processes, improving responses to risk, and building a solid foundation of threat and
vulnerability information tailored to organizational missions/business functions.
41 NIST Special Publication 800-137 provides guidance on information security continuous monitoring for information
systems and organizations.