03.11.01 Risk Assessment

Statement

• a. Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI.

• b. Update risk assessments {{ insert: param, A.03.11.01.ODP.01 }}.

Guidance

Establishing the system boundary is a prerequisite to assessing the risk of the unauthorized disclosure of CUI. Risk assessments consider threats, vulnerabilities, likelihood, and adverse impacts to organizational operations and assets based on the operation and use of the system and the unauthorized disclosure of CUI. Risk assessments also consider risks from external parties (e.g., contractors operating systems on behalf of the organization, service providers, individuals accessing systems, and outsourcing entities). Risk assessments can be conducted at the organization level, the mission or business process level, or the system level and at any phase in the system development life cycle. Risk assessments include supply chain-related risks associated with suppliers or contractors and the system, system component, or system service that they provide.

Assessment objective

the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.

Assessment objective

risk assessments are updated {{ insert: param, A.03.11.01.ODP.01 }}.

Assessment method

• risk assessment policy and procedures security planning policy and procedures procedures for organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates SCRM policy and procedures inventory of critical systems, system components, and system services procedures for organizational assessments of supply chain risk acquisition policy SCRM plan system security plan other relevant documents or records

Assessment method

• personnel with risk assessment responsibilities personnel with SCRM responsibilities personnel with security responsibilities

Assessment method

• processes for organizational risk assessments mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating risk assessments mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating supply chain risk assessments

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final