Guide for Conducting Risk Assessments
CHAPTER 3 > 3.4 MAINTAINING THE RISK ASSESSMENT > TASK 4-1: Conduct ongoing monitoring of the risk factors that contribute to changes in risk to organizational

STEP 4: MAINTAIN THE ASSESSMENT

MONITOR RISK FACTORS

TASK 4-1: Conduct ongoing monitoring of the risk factors that contribute to changes in risk to organizational

operations and assets, individuals, other organizations, or the Nation.
Supplemental Guidance: Organizations monitor risk factors of importance on an ongoing basis to ensure that the
information needed to make credible, risk-based decisions continues to be available over time. Monitoring risk factors
(e.g., threat sources and threat events, vulnerabilities and predisposing conditions, capabilities and intent of adversaries,
targeting of organizational operations, assets, or individuals) can provide critical information on changing conditions
that could potentially affect the ability of organizations to conduct core missions and business functions. Information
derived from the ongoing monitoring of risk factors can be used to refresh risk assessments at whatever frequency
deemed appropriate. Organizations can also attempt to capture changes in the effectiveness of risk response measures
in order to maintain the currency of risk assessments. The objective is to maintain an ongoing situational awareness of
the organizational governance structures and activities, mission/business processes, information systems, and
environments of operation, and thereby all of the risk factors that may affect the risk being incurred by organizations.
Therefore, in applying the risk assessment context or risk frame (i.e., scope, purpose, assumptions, constraints, risk
tolerances, priorities, and trade-offs), organizations consider the part risk factors play in the risk response plan
executed. For example, it is expected to be quite common for the security posture of information systems (that is, the
risk factors measured within those systems) to reflect only a part of the organizational risk response, with response
actions at the organization level or mission/business process level providing a significant portion of that response. In
48 Risk monitoring, the fourth step in the risk management process, is described in NIST Special Publication 800-39.
The step in the risk assessment process to maintain the assessment results over time overlaps to some degree with the
risk monitoring step in the risk management process and the continuous monitoring step in the RMF. This overlap
reinforces the important concept that many of the activities in the risk management process are complementary and
mutually reinforcing. For example, the continuous monitoring step in the RMF can be used to monitor the ongoing
effectiveness of deployed security controls with the results used to inform and guide a more extensive organizational
risk monitoring process. At the organization level, risk monitoring may include monitoring key risk factors that are
necessary to conduct subsequent risk assessments. Organizations use the risk management strategy to convey key
requirements for maintaining risk assessments including, for example, risk factors to monitor and the frequency of such
monitoring.
49 NIST Special Publication 800-137 provides guidance on the ongoing monitoring of organizational information
systems and environments of operation.
50 Compliance verification ensures that organizations have implemented required risk response measures and that
information security requirements derived from and traceable to organizational missions/business functions, federal
legislation, directives, regulations, policies, and standards/guidelines are satisfied.