Template:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan/A simplified description of NIST Special Publication 800-53 controls, with ties to LIMSpec/Appendix 1.16 Risk assessment

Appendix 1.16 Risk assessment

RA-1 Policy and procedures

This control recommends the organization develop, document, disseminate, review, and update risk assessment policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of risk assessment action but also to address how those policies and procedures will be implemented, reviewed, and updated.

Additional resources:

NIST Special Publications 800-12, Rev. 1, pages 68–69
NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-100, pages 84–95
LIMSpec 7.1, 7.2

RA-2 Security categorization

This control recommends the organization categorize the information system and its data based on security. More specifically, NIST notes the security categorization should be based upon "the potential adverse impacts or negative consequences to organizational operations, organizational assets, and individuals if organizational information and systems are compromised through a loss of confidentiality, integrity, or availability." Additionally, the organization should document the results and supporting rationale of the security categorization and ensure the results are reviewed and approved by the authorizing individuals or roles in the organization.

Additional resources:

NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-39
NIST Special Publications 800-60, Vol. 1, Rev. 1
NIST Special Publications 800-60, Vol. 2, Rev. 1
No LIMSpec comp (organizational policy rather than system specification)

RA-3 Risk assessment

This control recommends the organization conduct risk assessments of the information system and the data that is processed, stored, and transmitted within it. The assessment should address the likelihood and potential outcomes of unauthorized "access, use, disclosure, disruption, modification, or destruction" of the system and its data. The results of this assessment should be documented as part of a security plan, risk assessment report, or some other type of organizational document and disseminated to the appropriate individuals. The document should be reviewed at a defined frequency updated when significant changes to the system or cybersecurity threats occur.

Additional resources:

NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-39
No LIMSpec comp (organizational policy rather than system specification)

RA-5 Vulnerability monitoring and scanning

This control recommends the organization conduct vulnerability monitoring and scanning of its system. "Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly." This scanning should occur at a defined frequency, randomly as part of organizational processes, or when new vulnerabilities have been identified. The tools employed should be standardized to detect software flaws and improper configurations using formatting checklists test procedures, while also measuring vulnerability impact. The organizations should analyze the results of these scans, remediated legitimate vulnerabilities, and share details with appropriate personnel or roles, particularly when vulnerabilities may affect other portions of the system. The organization may also wish to tap into security vulnerability reports from public entities as part of its monitoring.

Additional resources: