ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
APPENDIX D

TABLE D-6: ASSESSMENT SCALE - RANGE OF EFFECTS FOR NON-ADVERSARIAL THREAT SOURCES
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The effects of the error, accident, or act of nature are sweeping, involving almost all of the cyber
resources of the [Tier 3: information systems; Tier 2: mission/business processes or EA segments,
common infrastructure, or support services; Tier 1: organization/governance structure].
High
80-95
The effects of the error, accident, or act of nature are extensive, involving most of the cyber
resources of the [Tier 3: information systems; Tier 2: mission/business processes or EA segments,
common infrastructure, or support services; Tier 1: organization/governance structure], including
many critical resources.
Moderate
21-79
The effects of the error, accident, or act of nature are wide-ranging, involving a significant portion
of the cyber resources of the [Tier 3: information systems; Tier 2: mission/business processes or
EA segments, common infrastructure, or support services; Tier 1: organization/governance
structure], including some critical resources.
Low
5-20
The effects of the error, accident, or act of nature are limited, involving some of the cyber
resources of the [Tier 3: information systems; Tier 2: mission/business processes or EA segments,
common infrastructure, or support services; Tier 1: organization/governance structure], but
involving no critical resources.
Very Low
0-4
The effects of the error, accident, or act of nature are minimal, involving few if any of the cyber
resources of the [Tier 3: information systems; Tier 2: mission/business processes or EA segments,
common infrastructure, or support services; Tier 1: organization/governance structure], and
involving no critical resources.
TABLE D-7: TEMPLATE - IDENTIFICATION OF ADVERSARIAL THREAT SOURCES
Identifier
Threat Source
Source of Information
In
Scope
Capability
Intent
Targeting
Organization
-defined
Table D-2 and Task 1-4
or
Organization-defined
Yes / No
Table D-3
or
Organization
-defined
Table D-4
or
Organization
-defined
Table D-5
or
Organization
-defined
TABLE D-8: TEMPLATE - IDENTIFICATION OF NON-ADVERSARIAL THREAT SOURCES
Identifier
Threat Source
Source of Information
In
Scope
Range of Effects
Organization
-defined
Table D-2 and Task 1-4
or
Organization-defined
Yes / No
Table D-6
or
Organization-defined
Guide for Conducting Risk Assessments
APPENDIX E

TABLE E-3: REPRESENTATIVE EXAMPLES - NON-ADVERSARIAL THREAT EVENTS
Threat Event
Description
Spill sensitive
information
Authorized user erroneously contaminates a device, information system, or network by placing on it or sending to it
information of a classification/sensitivity which it has not been authorized to handle. The information is exposed to
access by unauthorized individuals, and as a result, the device, system, or network is unavailable while the spill is
investigated and mitigated.
Mishandling of critical
and/or sensitive
information by
authorized users
Authorized privileged user inadvertently exposes critical/sensitive information.
Incorrect privilege
settings
Authorized privileged user or administrator erroneously assigns a user exceptional privileges or sets privilege
requirements on a resource too low.
Communications
contention
Degraded communications performance due to contention.
Unreadable display
Display unreadable due to aging equipment.
Earthquake at primary
facility
Earthquake of organization-defined magnitude at primary facility makes facility inoperable.
Fire at primary facility
Fire (not due to adversarial activity) at primary facility makes facility inoperable.
Fire at backup facility
Fire (not due to adversarial activity) at backup facility makes facility inoperable or destroys backups of software,
configurations, data, and/or logs.
Flood at primary
facility
Flood (not due to adversarial activity) at primary facility makes facility inoperable.
Flood at backup
facility
Flood (not due to adversarial activity) at backup facility makes facility inoperable or destroys backups of software,
configurations, data, and/or logs.
Hurricane at primary
facility
Hurricane of organization-defined strength at primary facility makes facility inoperable.
Hurricane at backup
facility
Hurricane of organization-defined strength at backup facility makes facility inoperable or destroys backups of software,
configurations, data, and/or logs.
Resource depletion
Degraded processing performance due to resource depletion.
Introduction of
vulnerabilities into
software products
Due to inherent weaknesses in programming languages and software development environments, errors and
vulnerabilities are introduced into commonly used software products.
Disk error
Corrupted storage due to a disk error.
Pervasive disk error
Multiple disk errors due to aging of a set of devices all acquired at the same time, from the same supplier.
Windstorm/tornado at
primary facility
Windstorm/tornado of organization-defined strength at primary facility makes facility inoperable.
Windstorm/tornado at
backup facility
Windstorm/tornado of organization-defined strength at backup facility makes facility inoperable or destroys backups of
software, configurations, data, and/or logs.
Guide for Conducting Risk Assessments
APPENDIX E

TABLE E-4: RELEVANCE OF THREAT EVENTS
Value
Description
Confirmed
The threat event or TTP has been seen by the organization.
Expected
The threat event or TTP has been seen by the organization's peers or partners.
Anticipated
The threat event or TTP has been reported by a trusted source.
Predicted
The threat event or TTP has been predicted by a trusted source.
Possible
The threat event or TTP has been described by a somewhat credible source.
N/A
The threat event or TTP is not currently applicable. For example, a threat event or TTP could assume specific technologies,
architectures, or processes that are not present in the organization, mission/business process, EA segment, or information
system; or predisposing conditions that are not present (e.g., location in a flood plain). Alternately, if the organization is using
detailed or specific threat information, a threat event or TTP could be deemed inapplicable because information indicates that
no adversary is expected to initiate the threat event or use the TTP.
TABLE E-5: TEMPLATE - IDENTIFICATION OF THREAT EVENTS
Identifier
Threat Event
Source of Information
Threat Source
Relevance
Organization
-defined
Table E-2, Table E-3, Task 1-4
or
Organization-defined
Table D-7, Table D-8
or
Organization-defined
Table E-4
or
Organization-
defined
Guide for Conducting Risk Assessments
APPENDIX F

TABLE F-2: ASSESSMENT SCALE - VULNERABILITY SEVERITY
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The vulnerability is exposed and exploitable, and its exploitation could result in severe impacts.
Relevant security control or other remediation is not implemented and not planned; or no security
measure can be identified to remediate the vulnerability.
High
80-95
The vulnerability is of high concern, based on the exposure of the vulnerability and ease of
exploitation and/or on the severity of impacts that could result from its exploitation.
Relevant security control or other remediation is planned but not implemented; compensating
controls are in place and at least minimally effective.
Moderate
21-79
The vulnerability is of moderate concern, based on the exposure of the vulnerability and ease of
exploitation and/or on the severity of impacts that could result from its exploitation.
Relevant security control or other remediation is partially implemented and somewhat effective.
Low
5-20
The vulnerability is of minor concern, but effectiveness of remediation could be improved.
Relevant security control or other remediation is fully implemented and somewhat effective.
Very Low
0-4
The vulnerability is not of concern.
Relevant security control or other remediation is fully implemented, assessed, and effective.
TABLE F-3: TEMPLATE - IDENTIFICATION OF VULNERABILITIES
Identifier
Vulnerability
Source of Information
Vulnerability
Severity
Organization-
defined
Guide for Conducting Risk Assessments
APPENDIX F

Task 2-3, Task 1-4

or
Organization-defined
Table F-2
or
Organization-defined

TABLE F-4: TAXONOMY OF PREDISPOSING CONDITIONS
Type of Predisposing Condition
Description
INFORMATION-RELATED
- Classified National Security Information
- Compartments
- Controlled Unclassified Information
- Personally Identifiable Information
- Special Access Programs
- Agreement-Determined
- NOFORN
- Proprietary
Needs to handle information (as it is created, transmitted, stored,
processed, and/or displayed) in a specific manner, due to its sensitivity
(or lack of sensitivity), legal or regulatory requirements, and/or contractual
or other organizational agreements.
TECHNICAL
- Architectural
- Compliance with technical standards
- Use of specific products or product lines
- Solutions for and/or approaches to user-based collaboration
and information sharing
- Allocation of specific security functionality to common controls
- Functional
- Networked multiuser
- Single-user
- Stand-alone / nonnetworked
- Restricted functionality (e.g., communications, sensors,
embedded controllers)
Needs to use technologies in specific ways.
OPERATIONAL / ENVIRONMENTAL
- Mobility
- Fixed-site (specify location)
- Semi-mobile
- Land-based, Airborne, Sea-based, Space-based
- Mobile (e.g., handheld device)
- Population with physical and/or logical access to components
of the information system, mission/business process, EA segment
- Size of population
- Clearance/vetting of population
Ability to rely upon physical, procedural, and personnel controls provided
by the operational environment.
TABLE F-5: ASSESSMENT SCALE - PERVASIVENESS OF PREDISPOSING CONDITIONS
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
Applies to all organizational missions/business functions (Tier 1), mission/business processes
(Tier 2), or information systems (Tier 3).
High
80-95
Applies to most organizational missions/business functions (Tier 1), mission/business processes
(Tier 2), or information systems (Tier 3).
Moderate
21-79
Applies to many organizational missions/business functions (Tier 1), mission/business processes
(Tier 2), or information systems (Tier 3).
Low
5-20
Applies to some organizational missions/business functions (Tier 1), mission/business processes
(Tier 2), or information systems (Tier 3).
Very Low
0-4
Applies to few organizational missions/business functions (Tier 1), mission/business processes
(Tier 2), or information systems (Tier 3).
Guide for Conducting Risk Assessments
APPENDIX F

TABLE F-6: TEMPLATE - IDENTIFICATION OF PREDISPOSING CONDITIONS
Identifier
Predisposing Condition
Source of Information
Pervasiveness
of Condition
Organization-
defined
Table F-4, Task 1-4
or
Organization-defined
Table F-5
or
Organization-defined
Guide for Conducting Risk Assessments
APPENDIX G

TABLE G-2: ASSESSMENT SCALE - LIKELIHOOD OF THREAT EVENT INITIATION (ADVERSARIAL)
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
Adversary is almost certain to initiate the threat event.
High
80-95
Adversary is highly likely to initiate the threat event.
Moderate
21-79
Adversary is somewhat likely to initiate the treat event.
Low
5-20
Adversary is unlikely to initiate the threat event.
Very Low
0-4
Adversary is highly unlikely to initiate the threat event.
TABLE G-3: ASSESSMENT SCALE - LIKELIHOOD OF THREAT EVENT OCCURRENCE (NON-ADVERSARIAL)
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
Error, accident, or act of nature is almost certain to occur; or occurs more than 100 times a year.
High
80-95
Error, accident, or act of nature is highly likely to occur; or occurs between 10-100 times a year.
Moderate
21-79
Error, accident, or act of nature is somewhat likely to occur; or occurs between 1-10 times a
year.
Low
5-20
Error, accident, or act of nature is unlikely to occur; or occurs less than once a year, but more
than once every 10 years.
Very Low
0-4
Error, accident, or act of nature is highly unlikely to occur; or occurs less than once every 10
years.
TABLE G-4: ASSESSMENT SCALE - LIKELIHOOD OF THREAT EVENT RESULTING IN ADVERSE IMPACTS
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
If the threat event is initiated or occurs, it is almost certain to have adverse impacts.
High
80-95
If the threat event is initiated or occurs, it is highly likely to have adverse impacts.
Moderate
21-79
If the threat event is initiated or occurs, it is somewhat likely to have adverse impacts.
Low
5-20
If the threat event is initiated or occurs, it is unlikely to have adverse impacts.
Very Low
0-4
If the threat event is initiated or occurs, it is highly unlikely to have adverse impacts.
TABLE G-5: ASSESSMENT SCALE - OVERALL LIKELIHOOD
Likelihood of
Threat Event
Initiation or
Occurrence
Likelihood Threat Events Result in Adverse Impacts
Very Low
Low
Moderate
High
Very High
Very High
Low
Moderate
High
Very High
Very High
High
Low
Moderate
Moderate
High
Very High
Moderate
Low
Low
Moderate
Moderate
High
Low
Very Low
Low
Low
Moderate
Moderate
Very Low
Very Low
Very Low
Low
Low
Low
Guide for Conducting Risk Assessments
APPENDIX H

TABLE H-2: EXAMPLES OF ADVERSE IMPACTS
Type of Impact
Impact
HARM TO
OPERATIONS
- Inability to perform current missions/business functions.
- In a sufficiently timely manner.
- With sufficient confidence and/or correctness.
- Within planned resource constraints.
- Inability, or limited ability, to perform missions/business functions in the future.
- Inability to restore missions/business functions.
- In a sufficiently timely manner.
- With sufficient confidence and/or correctness.
- Within planned resource constraints.
- Harms (e.g., financial costs, sanctions) due to noncompliance.
- With applicable laws or regulations.
- With contractual requirements or other requirements in other binding agreements (e.g., liability).
- Direct financial costs.
- Relational harms.
- Damage to trust relationships.
- Damage to image or reputation (and hence future or potential trust relationships).
HARM TO ASSETS
- Damage to or loss of physical facilities.
- Damage to or loss of information systems or networks.
- Damage to or loss of information technology or equipment.
- Damage to or loss of component parts or supplies.
- Damage to or of loss of information assets.
- Loss of intellectual property.
HARM TO INDIVIDUALS
- Injury or loss of life.
- Physical or psychological mistreatment.
- Identity theft.
- Loss of Personally Identifiable Information.
- Damage to image or reputation.
HARM TO OTHER
ORGANIZATIONS
- Harms (e.g., financial costs, sanctions) due to noncompliance.
- With applicable laws or regulations.
- With contractual requirements or other requirements in other binding agreements.
- Direct financial costs.
- Relational harms.
- Damage to trust relationships.
- Damage to reputation (and hence future or potential trust relationships).
HARM TO THE NATION
- Damage to or incapacitation of a critical infrastructure sector.
- Loss of government continuity of operations.
- Relational harms.
- Damage to trust relationships with other governments or with nongovernmental entities.
- Damage to national reputation (and hence future or potential trust relationships).
- Damage to current or future ability to achieve national objectives.
- Harm to national security.
Guide for Conducting Risk Assessments
APPENDIX H

TABLE H-3: ASSESSMENT SCALE - IMPACT OF THREAT EVENTS
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
The threat event could be expected to have multiple severe or catastrophic adverse effects on
organizational operations, organizational assets, individuals, other organizations, or the Nation.
High
80-95
The threat event could be expected to have a severe or catastrophic adverse effect on
organizational operations, organizational assets, individuals, other organizations, or the Nation. A
severe or catastrophic adverse effect means that, for example, the threat event might: (i) cause a
severe degradation in or loss of mission capability to an extent and duration that the organization is
not able to perform one or more of its primary functions; (ii) result in major damage to
organizational assets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm
to individuals involving loss of life or serious life-threatening injuries.
Moderate
21-79
The threat event could be expected to have a serious adverse effect on organizational operations,
organizational assets, individuals other organizations, or the Nation. A serious adverse effect
means that, for example, the threat event might: (i) cause a significant degradation in mission
capability to an extent and duration that the organization is able to perform its primary functions,
but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to
organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to
individuals that does not involve loss of life or serious life-threatening injuries.
Low
5-20
The threat event could be expected to have a limited adverse effect on organizational operations,
organizational assets, individuals other organizations, or the Nation. A limited adverse effect
means that, for example, the threat event might: (i) cause a degradation in mission capability to an
extent and duration that the organization is able to perform its primary functions, but the
effectiveness of the functions is noticeably reduced; (ii) result in minor damage to organizational
assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.
Very Low
0-4
The threat event could be expected to have a negligible adverse effect on organizational
operations, organizational assets, individuals other organizations, or the Nation.
TABLE H-4: TEMPLATE - IDENTIFICATION OF ADVERSE IMPACTS
Type of Impact
Impact
Affected Asset
Maximum Impact
Table H-2
or
Organization-
defined
Table H-2
or
Organization-defined
Table H-3
or
Organization-defined
Guide for Conducting Risk Assessments
APPENDIX I

TABLE I-3: ASSESSMENT SCALE - LEVEL OF RISK
Qualitative
Values
Semi-Quantitative
Values
Description
Very High
96-100
Very high risk means that a threat event could be expected to have multiple severe or
catastrophic adverse effects on organizational operations, organizational assets, individuals,
other organizations, or the Nation.
High
80-95
High risk means that a threat event could be expected to have a severe or catastrophic adverse
effect on organizational operations, organizational assets, individuals, other organizations, or the
Nation.
Moderate
21-79
Moderate risk means that a threat event could be expected to have a serious adverse effect on
organizational operations, organizational assets, individuals, other organizations, or the Nation.
Low
5-20
Low risk means that a threat event could be expected to have a limited adverse effect on
organizational operations, organizational assets, individuals, other organizations, or the Nation.
Very Low
0-4
Very low risk means that a threat event could be expected to have a negligible adverse effect on
organizational operations, organizational assets, individuals, other organizations, or the Nation.
Guide for Conducting Risk Assessments
APPENDIX I

TABLE I-4: COLUMN DESCRIPTIONS FOR ADVERSARIAL RISK TABLE
Column
Heading
Content
Threat Event
Identify threat event. (Task 2-2; Table E-1; Table E-2; Table E-5; Table I-5.)
Threat Sources
Identify threat sources that could initiate the threat event. (Task 2-1; Table D-1; Table D-2;
Table D-7; Table I-5.)
Capability
Assess threat source capability. (Task 2-1; Table D-3; Table D-7; Table I-5.)
Intent
Assess threat source intent. (Task 2-1; Table D-4; Table D-7; Table I-5.)
Targeting
Assess threat source targeting. (Task 2-1; Table D-5; Table D-7; Table I-5.)
Relevance
Determine relevance of threat event. (Task 2-2; Table E-1; Table E-4; Table E-5; Table I-5.)
If the relevance of the threat event does not meet the organization's criteria for further
consideration, do not complete the remaining columns.
Likelihood of Attack Initiation
Determine likelihood that one or more of the threat sources initiates the threat event, taking into
consideration capability, intent, and targeting. (Task 2-4; Table G-1; Table G-2; Table I-5.)
Vulnerabilities and
Predisposing Conditions
Identify vulnerabilities which could be exploited by threat sources initiating the threat event and
the predisposing conditions which could increase the likelihood of adverse impacts. (Task 2-5;
Table F-1; Table F-3; Table F-4; Table F-6; Table I-5.)
Severity
Pervasiveness
Assess severity of vulnerabilities and pervasiveness of predisposing conditions. (Task 2-5;
Table F-1; Table F-2; Table F-5; Table F-6; Table I-5.)
Likelihood Initiated Attack
Succeeds
Determine the likelihood that the threat event, once initiated, will result in adverse impact,
taking into consideration threat source capability, vulnerabilities, and predisposing conditions.
(Task 2-4; Table G-1; Table G-4; Table I-5.)
Overall Likelihood
Determine the likelihood that the threat event will be initiated and result in adverse impact (i.e.,
combination of likelihood of attack initiation and likelihood that initiated attack succeeds). (Task
2-4; Table G-1; Table G-5; Table I-5.)
Level of Impact
Determine the adverse impact (i.e., potential harm to organizational operations, organizational
assets, individuals, other organizations, or the Nation) from the threat event. (Task 2-5; Table
H-1, Table H-2; Table H-3; Table H-4; Table I-5.)
Risk
Determine the level of risk as a combination of likelihood and impact. (Task 2-6; Table I-1;
Table I-2; Table I-3; Table I-5.)
TABLE I-5: TEMPLATE - ADVERSARIAL RISK
Threat
Event
Threat
Sources
Threat Source
Characteristics
Relevance
Likelihood of
Attack Initiation
Vulnerabilities
and
Predisposing
Conditions
Severity and
Pervasiveness
Likelihood Initiated
Attack Succeeds
Overall Likelihood
Level
of
Impact
Risk
Capability
Intent
Targeting