Managing Information Security Risk: Organization, Mission, and Information System View
CHAPTER TWO > 2.4 TIER TWO—MISSION/BUSINESS PROCESS VIEW > ORGANIZATION

ORGANIZATION

RISK MANAGEMENT STRATEGY
Mission / Business
Process
Mission / Business
Process
Mission / Business
Process
ENTERPRISE ARCHITECTURE
(Reference Models, Segment Architecture, Solution Architecture)
INFORMATION SECURITY ARCHITECTURE
(Security Requirement and Control Allocation)
INFORMS
INFORMS
INFORMS
INFORMS
FIGURE 3: INFORMATION SECURITY REQUIREMENTS INTEGRATION
To summarize, risk management considerations can be addressed as an integral part of the
enterprise architecture by:
• Developing a segment architecture linked to the strategic goals and objectives of
organizations, defined missions/business functions, and associated mission/business
processes;
• Identifying where effective risk response is a critical element in the success of organizational
missions and business functions;
• Defining the appropriate, architectural-level information security requirements within
organization-defined segments based on the organization's risk management strategy;
• Incorporating an information security architecture that implements architectural-level
information security requirements;
39 Security control allocation occurs down to the information system component level, employing security controls in
selected system components assigned to provide a specific security capability. Specific guidance on how to incorporate
information security requirements into enterprise architecture is provided in the FEA Security and Privacy Profile.
• Translating the information security requirements from the segment architecture into specific
security controls for information systems/environments of operation as part of the solution
architecture;
• Allocating management, operational, and technical security controls to information systems
and environments of operation as defined by the information security architecture; and
• Documenting risk management decisions at all levels of the enterprise architecture.40
Enterprise architecture provides a disciplined and structured approach to achieving consolidation,
standardization, and optimization of information technology assets that are employed within
organizations. Risk reduction can be achieved through the full integration of management
processes41 organization-wide, thereby providing greater degrees of security, privacy, reliability,
and cost-effectiveness for the missions and business functions being carried out by organizations.
This integrated approach of incorporating the organization's risk management strategy into
enterprise architecture gives senior leaders/executives the opportunity to make more informed
risk-based decisions in dynamic operating environments-decisions based on trade-offs between
fulfilling and improving organizational missions and business functions and managing the many
types and sources of risk that must be considered in their risk management responsibilities.
The use of enterprise architecture can greatly enhance an organization's risk posture by providing
greater transparency and clarity in design and development activities-enabling a more consistent
application of the principle of 'wise use' of technologies across the organization; optimizing the
trade‐offs between value gained from and the risk being incurred through the information systems
supporting organizational missions/business functions.