+RA Risk Assessment
---+RA-01 Policy and Procedures
---+RA-02 Security Categorization
------+RA-02(01) Impact-level Prioritization
---+RA-03 Risk Assessment
------+RA-03(01) Supply Chain Risk Assessment
------+RA-03(02) Use of All-source Intelligence
------+RA-03(03) Dynamic Threat Awareness
------+RA-03(04) Predictive Cyber Analytics
---+RA-04 Risk Assessment Update
---+RA-05 Vulnerability Monitoring and Scanning
------+RA-05(02) Update Vulnerabilities to Be Scanned
------+RA-05(03) Breadth and Depth of Coverage
------+RA-05(04) Discoverable Information
------+RA-05(05) Privileged Access
------+RA-05(06) Automated Trend Analyses
------+RA-05(08) Review Historic Audit Logs
------+RA-05(10) Correlate Scanning Information
------+RA-05(11) Public Disclosure Program
---+RA-06 Technical Surveillance Countermeasures Survey
---+RA-07 Risk Response
---+RA-08 Privacy Impact Assessments
---+RA-09 Criticality Analysis
---+RA-10 Threat Hunting

RA Risk Assessment

Risk Assessment

1. Prehľad

RA-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
  3. Review and update the current risk assessment:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Risk assessment policy and procedures address the controls in the RA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of risk assessment policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to risk assessment policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a risk assessment policy is developed and documented;
    2. the risk assessment policy is disseminated to [Assignement: personnel or roles];
    3. risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;
    4. the risk assessment procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;
      1. the current risk assessment policy is reviewed and updated [Assignement: frequency];
      2. the current risk assessment policy is reviewed and updated following [Assignement: events];
      1. the current risk assessment procedures are reviewed and updated [Assignement: frequency];
      2. the current risk assessment procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Risk assessment policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-02 Security Categorization

Control

  1. Categorize the system and information it processes, stores, and transmits;
  2. Document the security categorization results, including supporting rationale, in the security plan for the system; and
  3. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

Discussion

Security categories describe the potential adverse impacts or negative consequences to organizational operations, organizational assets, and individuals if organizational information and systems are compromised through a loss of confidentiality, integrity, or availability. Security categorization is also a type of asset loss characterization in systems security engineering processes that is carried out throughout the system development life cycle. Organizations can use privacy risk assessments or privacy impact assessments to better understand the potential adverse effects on individuals. [CNSSI 1253](#4e4fbc93-333d-45e6-a875-de36b878b6b9) provides additional guidance on categorization for national security systems. Organizations conduct the security categorization process as an organization-wide activity with the direct involvement of chief information officers, senior agency information security officers, senior agency officials for privacy, system owners, mission and business owners, and information owners or stewards. Organizations consider the potential adverse impacts to other organizations and, in accordance with [USA PATRIOT](#13f0c39d-eaf7-417a-baef-69a041878bb5) and Homeland Security Presidential Directives, potential national-level adverse impacts. Security categorization processes facilitate the development of inventories of information assets and, along with [CM-8](#cm-8) , mappings to specific system components where information is processed, stored, or transmitted. The security categorization process is revisited throughout the system development life cycle to ensure that the security categories remain accurate and relevant.

Assessment Objective

  1. the system and the information it processes, stores, and transmits are categorized;
  2. the security categorization results, including supporting rationale, are documented in the security plan for the system;
  3. the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

Assessment Method

Examine

Risk assessment policy security planning policy and procedures procedures addressing security categorization of organizational information and systems security categorization documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security categorization and risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-03 Risk Assessment

Control

  1. Conduct a risk assessment, including:
    1. Identifying threats to and vulnerabilities in the system;
    2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
    3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
  2. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
  3. Document risk assessment results in [Selection: security and privacy plans; risk assessment report; {{ insert: param, ra-03_odp.02 }} ];
  4. Review risk assessment results [Assignement: frequency];
  5. Disseminate risk assessment results to [Assignement: personnel or roles] ; and
  6. Update the risk assessment [Assignement: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Discussion

Risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations and assets, individuals, other organizations, and the Nation. Risk assessments also consider risk from external parties, including contractors who operate systems on behalf of the organization, individuals who access organizational systems, service providers, and outsourcing entities. Organizations can conduct risk assessments at all three levels in the risk management hierarchy (i.e., organization level, mission/business process level, or information system level) and at any stage in the system development life cycle. Risk assessments can also be conducted at various steps in the Risk Management Framework, including preparation, categorization, control selection, control implementation, control assessment, authorization, and control monitoring. Risk assessment is an ongoing activity carried out throughout the system development life cycle. Risk assessments can also address information related to the system, including system design, the intended use of the system, testing results, and supply chain-related information or artifacts. Risk assessments can play an important role in control selection processes, particularly during the application of tailoring guidance and in the earliest phases of capability determination.

Assessment Objective

    1. a risk assessment is conducted to identify threats to and vulnerabilities in the system;
    2. a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;
    3. a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
  2. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;
  3. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; {{ insert: param, ra-03_odp.02 }} ];
  4. risk assessment results are reviewed [Assignement: frequency];
  5. risk assessment results are disseminated to [Assignement: personnel or roles];
  6. the risk assessment is updated [Assignement: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Assessment Method

Examine

Risk assessment policy risk assessment procedures security and privacy planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with risk assessment responsibilities organizational personnel with security and privacy responsibilities
RA-04 Risk Assessment Update

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview
RA-05 Vulnerability Monitoring and Scanning

Control

  1. Monitor and scan for vulnerabilities in the system and hosted applications [Assignement: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
  2. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
    1. Enumerating platforms, software flaws, and improper configurations;
    2. Formatting checklists and test procedures; and
    3. Measuring vulnerability impact;
  3. Analyze vulnerability scan reports and results from vulnerability monitoring;
  4. Remediate legitimate vulnerabilities [Assignement: response times] in accordance with an organizational assessment of risk;
  5. Share information obtained from the vulnerability monitoring process and control assessments with [Assignement: personnel or roles] to help eliminate similar vulnerabilities in other systems; and
  6. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.

Discussion

Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers. Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). Vulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation. Organizations may also employ the use of financial incentives (also known as "bug bounties" ) to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points.

Assessment Objective

    1. systems and hosted applications are monitored for vulnerabilities [Assignement: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
    2. systems and hosted applications are scanned for vulnerabilities [Assignement: frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
  2. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools;
    1. vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations;
    2. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures;
    3. vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact;
  3. vulnerability scan reports and results from vulnerability monitoring are analyzed;
  4. legitimate vulnerabilities are remediated [Assignement: response times] in accordance with an organizational assessment of risk;
  5. information obtained from the vulnerability monitoring process and control assessments is shared with [Assignement: personnel or roles] to help eliminate similar vulnerabilities in other systems;
  6. vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.

Assessment Method

Examine

Risk assessment policy procedures addressing vulnerability scanning risk assessment assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records

Interview

Organizational personnel with risk assessment, control assessment, and vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with vulnerability remediation responsibilities organizational personnel with security responsibilities system/network administrators
RA-06 Technical Surveillance Countermeasures Survey

Control

Employ a technical surveillance countermeasures survey at [Assignement: locations] [Selection(one-or-more): {{ insert: param, ra-06_odp.03 }} ; when {{ insert: param, ra-06_odp.04 }} ].

Discussion

A technical surveillance countermeasures survey is a service provided by qualified personnel to detect the presence of technical surveillance devices and hazards and to identify technical security weaknesses that could be used in the conduct of a technical penetration of the surveyed facility. Technical surveillance countermeasures surveys also provide evaluations of the technical security posture of organizations and facilities and include visual, electronic, and physical examinations of surveyed facilities, internally and externally. The surveys also provide useful input for risk assessments and information regarding organizational exposure to potential adversaries.

Assessment Objective

a technical surveillance countermeasures survey is employed at [Assignement: locations] [Selection(one-or-more): {{ insert: param, ra-06_odp.03 }} ; when {{ insert: param, ra-06_odp.04 }} ].

Assessment Method

Examine

Risk assessment policy procedures addressing technical surveillance countermeasures surveys audit records/event logs system security plan other relevant documents or records

Interview

Organizational personnel with technical surveillance countermeasures surveys responsibilities system/network administrators organizational personnel with security responsibilities
RA-07 Risk Response

Control

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

Discussion

Organizations have many options for responding to risk including mitigating risk by implementing new controls or strengthening existing controls, accepting risk with appropriate justification or rationale, sharing or transferring risk, or avoiding risk. The risk tolerance of the organization influences risk response decisions and actions. Risk response addresses the need to determine an appropriate response to risk before generating a plan of action and milestones entry. For example, the response may be to accept risk or reject risk, or it may be possible to mitigate the risk immediately so that a plan of action and milestones entry is not needed. However, if the risk response is to mitigate the risk, and the mitigation cannot be completed immediately, a plan of action and milestones entry is generated.

Assessment Objective

  1. findings from security assessments are responded to in accordance with organizational risk tolerance;
  2. findings from privacy assessments are responded to in accordance with organizational risk tolerance;
  3. findings from monitoring are responded to in accordance with organizational risk tolerance;
  4. findings from audits are responded to in accordance with organizational risk tolerance.

Assessment Method

Examine

Risk assessment policy assessment reports audit records/event logs system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with assessment and auditing responsibilities system/network administrators organizational personnel with security and privacy responsibilities
RA-08 Privacy Impact Assessments

Control

Conduct privacy impact assessments for systems, programs, or other activities before:
  1. Developing or procuring information technology that processes personally identifiable information; and
  2. Initiating a new collection of personally identifiable information that:
    1. Will be processed using information technology; and
    2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Discussion

A privacy impact assessment is an analysis of how personally identifiable information is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information system or activity, and evaluate ways to mitigate privacy risks. A privacy impact assessment is both an analysis and a formal document that details the process and the outcome of the analysis. Organizations conduct and develop a privacy impact assessment with sufficient clarity and specificity to demonstrate that the organization fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the organization’s activity and throughout the information life cycle. In order to conduct a meaningful privacy impact assessment, the organization’s senior agency official for privacy works closely with program managers, system owners, information technology experts, security officials, counsel, and other relevant organization personnel. Moreover, a privacy impact assessment is not a time-restricted activity that is limited to a particular milestone or stage of the information system or personally identifiable information life cycles. Rather, the privacy analysis continues throughout the system and personally identifiable information life cycles. Accordingly, a privacy impact assessment is a living document that organizations update whenever changes to the information technology, changes to the organization’s practices, or other factors alter the privacy risks associated with the use of such information technology. To conduct the privacy impact assessment, organizations can use security and privacy risk assessments. Organizations may also use other related processes that may have different names, including privacy threshold analyses. A privacy impact assessment can also serve as notice to the public regarding the organization’s practices with respect to privacy. Although conducting and publishing privacy impact assessments may be required by law, organizations may develop such policies in the absence of applicable laws. For federal agencies, privacy impact assessments may be required by [EGOV](#7b0b9634-741a-4335-b6fa-161228c3a76e) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.

Assessment Objective

  1. privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;
    1. privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;
    2. privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Assessment Method

Examine

Risk assessment policy security and privacy risk assessment reports acquisitions documents system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with assessment and auditing responsibilities system/network administrators system developers program managers legal counsel organizational personnel with security and privacy responsibilities
RA-09 Criticality Analysis

Control

Identify critical system components and functions by performing a criticality analysis for [Assignement: systems, system components, or system services] at [Assignement: decision points in the system development life cycle].

Discussion

Not all system components, functions, or services necessarily require significant protections. For example, criticality analysis is a key tenet of supply chain risk management and informs the prioritization of protection activities. The identification of critical system components and functions considers applicable laws, executive orders, regulations, directives, policies, standards, system functionality requirements, system and component interfaces, and system and component dependencies. Systems engineers conduct a functional decomposition of a system to identify mission-critical functions and components. The functional decomposition includes the identification of organizational missions supported by the system, decomposition into the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by many components within and external to the system. The operational environment of a system or a system component may impact the criticality, including the connections to and dependencies on cyber-physical systems, devices, system-of-systems, and outsourced IT services. System components that allow unmediated access to critical system components or functions are considered critical due to the inherent vulnerabilities that such components create. Component and function criticality are assessed in terms of the impact of a component or function failure on the organizational missions that are supported by the system that contains the components and functions. Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early in the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these components and functions, such as by adding redundancy or alternate paths into the system design. Criticality analysis can also influence the protection measures required by development contractors. In addition to criticality analysis for systems, system components, and system services, criticality analysis of information is an important consideration. Such analysis is conducted as part of security categorization in [RA-2](#ra-2).

Assessment Objective

critical system components and functions are identified by performing a criticality analysis for [Assignement: systems, system components, or system services] at [Assignement: decision points in the system development life cycle].

Assessment Method

Examine

Risk assessment policy assessment reports criticality analysis/finalized criticality for each component/subcomponent audit records/event logs analysis reports system security plan other relevant documents or records

Interview

Organizational personnel with assessment and auditing responsibilities organizational personnel with criticality analysis responsibilities system/network administrators organizational personnel with security responsibilities
RA-10 Threat Hunting

Control

  1. Establish and maintain a cyber threat hunting capability to:
    1. Search for indicators of compromise in organizational systems; and
    2. Detect, track, and disrupt threats that evade existing controls; and
  2. Employ the threat hunting capability [Assignement: frequency].

Discussion

Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt cyber adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of organizational responses. Indications of compromise include unusual network traffic, unusual file changes, and the presence of malicious code. Threat hunting teams leverage existing threat intelligence and may create new threat intelligence, which is shared with peer organizations, Information Sharing and Analysis Organizations (ISAO), Information Sharing and Analysis Centers (ISAC), and relevant government departments and agencies.

Assessment Objective

    1. a cyber threat capability is established and maintained to search for indicators of compromise in organizational systems;
    2. a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade existing controls;
  2. the threat hunting capability is employed [Assignement: frequency].

Assessment Method

Examine

Risk assessment policy assessment reports audit records/event logs threat hunting capability system security plan other relevant documents or records

Interview

Organizational personnel with threat hunting responsibilities system/network administrators organizational personnel with security responsibilities

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy