Overview:
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of CUI.
Action Items:
3.11.1[a]
Determine if: the frequency to assess risk to organizational operations, organizational assets, and individuals is defined.
3.11.1[b]
Determine if: risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Risk assessment policy; security planning policy and procedures; procedures addressing organizational risk assessments; system security plan; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; other relevant documents or records].
2
Interview: Personnel with risk assessment responsibilities; personnel with information security responsibilities].
3
Test: Organizational processes for risk assessment; mechanisms supporting or for conducting, documenting, reviewing, disseminating, and updating the risk assessment].
Related Documents (document name and content will vary by organization):
1) Risk assessment policy
2) security planning policy and procedures
3) procedures addressing organizational risk assessments
4) system security plan
5) risk assessment
6) risk assessment results
7) risk assessment reviews
8) risk assessment updates
9) other relevant documents or records
Additional Guidance:
Clearly defined system boundaries are a prerequisite for effective risk assessments. Such risk assessments consider threats, vulnerabilities, likelihood, and impact to organizational operations, organizational assets, and individuals based on the operation and use of organizational systems. Risk assessments also consider risk from external parties (e.g., service providers, contractors operating systems on behalf of the organization, individuals accessing organizational systems, outsourcing entities). Risk assessments, either formal or informal, can be conducted at the organization level, the mission or business process level, or the system level, and at any phase in the system development life cycle. NIST Special Publication 800-30 provides guidance on conducting risk assessments.
Article ID: 186
Created: September 26, 2022
Last Updated: September 26, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-risk-assessment-3-11-1-186.html