+RA [P] Risk Assessment
---+RA-01 [P] Policy and Procedures
---+RA-03 [P] Risk Assessment
---+RA-07 [P] Risk Response
---+RA-08 [P] Privacy Impact Assessments

RA [P] Risk Assessment

Risk Assessment

1. Przegląd

RA-01 [P] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
  3. Review and update the current risk assessment:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Risk assessment policy and procedures address the controls in the RA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of risk assessment policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to risk assessment policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a risk assessment policy is developed and documented;
    2. the risk assessment policy is disseminated to [Assignement: personnel or roles];
    3. risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;
    4. the risk assessment procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;
      1. the current risk assessment policy is reviewed and updated [Assignement: frequency];
      2. the current risk assessment policy is reviewed and updated following [Assignement: events];
      1. the current risk assessment procedures are reviewed and updated [Assignement: frequency];
      2. the current risk assessment procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Risk assessment policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-03 [P] Risk Assessment

Control

  1. Conduct a risk assessment, including:
    1. Identifying threats to and vulnerabilities in the system;
    2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
    3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
  2. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
  3. Document risk assessment results in [Selection: security and privacy plans; risk assessment report; {{ insert: param, ra-03_odp.02 }} ];
  4. Review risk assessment results [Assignement: frequency];
  5. Disseminate risk assessment results to [Assignement: personnel or roles] ; and
  6. Update the risk assessment [Assignement: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Discussion

Risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations and assets, individuals, other organizations, and the Nation. Risk assessments also consider risk from external parties, including contractors who operate systems on behalf of the organization, individuals who access organizational systems, service providers, and outsourcing entities. Organizations can conduct risk assessments at all three levels in the risk management hierarchy (i.e., organization level, mission/business process level, or information system level) and at any stage in the system development life cycle. Risk assessments can also be conducted at various steps in the Risk Management Framework, including preparation, categorization, control selection, control implementation, control assessment, authorization, and control monitoring. Risk assessment is an ongoing activity carried out throughout the system development life cycle. Risk assessments can also address information related to the system, including system design, the intended use of the system, testing results, and supply chain-related information or artifacts. Risk assessments can play an important role in control selection processes, particularly during the application of tailoring guidance and in the earliest phases of capability determination.

Assessment Objective

    1. a risk assessment is conducted to identify threats to and vulnerabilities in the system;
    2. a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;
    3. a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
  2. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;
  3. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; {{ insert: param, ra-03_odp.02 }} ];
  4. risk assessment results are reviewed [Assignement: frequency];
  5. risk assessment results are disseminated to [Assignement: personnel or roles];
  6. the risk assessment is updated [Assignement: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Assessment Method

Examine

Risk assessment policy risk assessment procedures security and privacy planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-07 [P] Risk Response

Control

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

Discussion

Organizations have many options for responding to risk including mitigating risk by implementing new controls or strengthening existing controls, accepting risk with appropriate justification or rationale, sharing or transferring risk, or avoiding risk. The risk tolerance of the organization influences risk response decisions and actions. Risk response addresses the need to determine an appropriate response to risk before generating a plan of action and milestones entry. For example, the response may be to accept risk or reject risk, or it may be possible to mitigate the risk immediately so that a plan of action and milestones entry is not needed. However, if the risk response is to mitigate the risk, and the mitigation cannot be completed immediately, a plan of action and milestones entry is generated.

Assessment Objective

  1. findings from security assessments are responded to in accordance with organizational risk tolerance;
  2. findings from privacy assessments are responded to in accordance with organizational risk tolerance;
  3. findings from monitoring are responded to in accordance with organizational risk tolerance;
  4. findings from audits are responded to in accordance with organizational risk tolerance.

Assessment Method

Examine

Risk assessment policy assessment reports audit records/event logs system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with assessment and auditing responsibilities system/network administrators organizational personnel with security and privacy responsibilities
RA-08 [P] Privacy Impact Assessments

Control

Conduct privacy impact assessments for systems, programs, or other activities before:
  1. Developing or procuring information technology that processes personally identifiable information; and
  2. Initiating a new collection of personally identifiable information that:
    1. Will be processed using information technology; and
    2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Discussion

A privacy impact assessment is an analysis of how personally identifiable information is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information system or activity, and evaluate ways to mitigate privacy risks. A privacy impact assessment is both an analysis and a formal document that details the process and the outcome of the analysis. Organizations conduct and develop a privacy impact assessment with sufficient clarity and specificity to demonstrate that the organization fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the organization’s activity and throughout the information life cycle. In order to conduct a meaningful privacy impact assessment, the organization’s senior agency official for privacy works closely with program managers, system owners, information technology experts, security officials, counsel, and other relevant organization personnel. Moreover, a privacy impact assessment is not a time-restricted activity that is limited to a particular milestone or stage of the information system or personally identifiable information life cycles. Rather, the privacy analysis continues throughout the system and personally identifiable information life cycles. Accordingly, a privacy impact assessment is a living document that organizations update whenever changes to the information technology, changes to the organization’s practices, or other factors alter the privacy risks associated with the use of such information technology. To conduct the privacy impact assessment, organizations can use security and privacy risk assessments. Organizations may also use other related processes that may have different names, including privacy threshold analyses. A privacy impact assessment can also serve as notice to the public regarding the organization’s practices with respect to privacy. Although conducting and publishing privacy impact assessments may be required by law, organizations may develop such policies in the absence of applicable laws. For federal agencies, privacy impact assessments may be required by [EGOV](#7b0b9634-741a-4335-b6fa-161228c3a76e) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.

Assessment Objective

  1. privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;
    1. privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;
    2. privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Assessment Method

Examine

Risk assessment policy security and privacy risk assessment reports acquisitions documents system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with assessment and auditing responsibilities system/network administrators system developers program managers legal counsel organizational personnel with security and privacy responsibilities

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje