Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER THREE > 3.2 ASSESSING RISK > TASK 2-2: Determine the risk to organizational operations and assets, individuals, other organizations, and (part 1)

TASK 2-2: Determine the risk to organizational operations and assets, individuals, other organizations, and

TASK 2-2: Determine the risk to organizational operations and assets, individuals, other organizations, and

the Nation if identified threats exploit identified vulnerabilities. Supplemental Guidance: Organizations determine risk by considering the likelihood that known threats exploit known
vulnerabilities and the resulting consequences or adverse impacts (i.e., magnitude of harm) if such exploitations occur. Organizations use threat and vulnerability information together with likelihood and consequences/impact information
to determine risk either qualitatively or quantitatively. Organizations can employ a variety of approaches to determine
the likelihood of threats exploiting vulnerabilities. Likelihood determinations can be based on either threat assumptions
or actual threat information (e.g., historical data on cyber attacks, historical data on earthquakes, or specific information
on adversary capabilities, intentions, and targeting). When specific and credible threat information is available (e.g.,
types of cyber attacks, cyber attack trends, frequencies of attacks), organizations can use empirical data and statistical
analyses to determine more specific probabilities of threats occurring. Assessment of likelihood can also be influenced
by whether vulnerability identification occurred at the individual weakness or deficiency level or at the root-cause
level. The relative ease/difficulty of vulnerability exploitation, the sophistication of adversaries, and the nature of
operational environments all influence the likelihood that threats exploit vulnerabilities. Organizations can characterize
adverse impacts by security objective (e.g., loss of confidentiality, integrity, or availability). However, to maximize
usefulness, adverse impact is expressed in or translated into terms of organizational missions, business functions, and
stakeholders. Risk Determination and Uncertainty
Risk determinations require analysis of threat, vulnerability, likelihood, and impact-related information. Organizations
also need to examine mission/business vulnerabilities and threats where safeguards and/or countermeasures do not
exist. The nature of the inputs provided to this step (e.g., general, specific, strategic, tactical) directly affects the type of
outputs or risk determinations made. The reliability and accuracy of risk determinations are dependent on the currency,
accuracy, completeness, and integrity of information collected to support the risk assessment process. In addition, the
components of risk assessment results that affect reliability and accuracy of risk determinations also affect the amount
of uncertainty associated with those risk determinations and subsequent determinations. Organizations also consider
additional insights related to the anticipated time frames associated with particular risks. Time horizons associated with
potential threats can shape future risk responses (e.g., risk may not be a concern if the time horizon for the risk is in the
distant future). Organizational guidance for determining risk under uncertainty indicates how combinations of likelihood and impact
are combined into a determination of the risk level or risk score/rating. Organizations need to understand the type and
amount of uncertainty surrounding risk decisions so that risk determinations can be understood. During the risk framing
step, organizations may have provided guidance on how to analyze risk and how to determine risk when a high degree
of uncertainty exists. Uncertainty is particularly a concern when the risk assessment considers advanced persistent
threats, for which analysis of interacting vulnerabilities may be needed, the common body of knowledge is sparse, and
past behavior may not be predictive. While threat and vulnerability determinations apply frequently to missions and business functions, the specific
requirements associated with the missions/business functions, including the environments of operation, may lead to
different assessment results. Different missions, business functions, and environments of operation can lead to
differences in the applicability of specific threat information considered and the likelihood of threats causing potential
harm. Understanding the threat component of the risk assessment requires insight into the particular threats facing
specific missions or business functions. Such awareness of threats includes understanding the capability, intent, and
targeting of particular adversaries. The risk tolerance of organizations and underlying beliefs associated with how the
risk tolerance is formed (including the culture within organizations) may shape the perception of impact and likelihood
in the context of identified threats and vulnerabilities. Even with the establishment of explicit criteria, risk assessments are influenced by organizational culture and the
personal experiences and accumulated knowledge of the individuals conducting the assessments. As a result, assessors
of risk can reach different conclusions from the same information. This diversity of perspective can enrich the risk
assessment process and provide decision makers with a greater array of information and potentially fewer biases. However, such diversity may also lead to risk assessments that are inconsistent. Organizationally-defined and applied
processes provide the means to identify inconsistent practices and include processes to identify and resolve such
inconsistencies. Outputs and Post Conditions
The output of the risk assessment step is a determination of risk to organizational operations (i.e., mission, functions,
image, and reputation), organizational assets, individuals, other organizations, and the Nation. Depending on the
approach that organizations take, either the overall risk to the organization or the inputs used to determine risk may be
communicated to the decision makers responsible for risk response. In certain situations, there are recurring cycles
between the risk assessment step and the risk response step until particular objectives are achieved.