Template:Cybersecurity/Risk assessment

RA-1 Risk assessment policy and procedures

This control recommends the organization develop, document, disseminate, review, and update risk assessment policies and procedures. It asks organizations to not only address the purpose, scope, roles, responsibilities, and enforcement of risk asssessment action but also to address how those policies and procedures will be implemented, reviewed, and updated.

Additional resources:

NIST Special Publications 800-12, Rev. 1, pages 68–69
NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-100, pages 84–95
LIMSpec 7.1, 7.2

RA-2 Security categorization

This control recommends the organization categorize the information system and its data based on security. More specifically, NIST notes the security categorization should be based upon "the potential adverse impacts to organizational operations, organizational assets, and individuals if organizational information and information systems are comprised through a loss of confidentiality, integrity, or availability." Additionally, the organization should document the results and supporting rationale of the security categorization and ensure the results are reviewed and approved by the authorizing individuals or roles in the organization.

Additional resources:

NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-39
NIST Special Publications 800-60, Vol. 1, Rev. 1
NIST Special Publications 800-60, Vol. 2, Rev. 1
No LIMSpec comp (organizational policy rather than system specification)

RA-3 Risk assessment

This control recommends the organization conduct risk assessments of the information system and the data that is processed, stored, and transmitted within it. The assessment should address the likelihood and potential outcomes of unauthorized "access, use, disclosure, disruption, modification, or destruction" of the system and its data. The results of this assessment should be documented as part of a security plan, risk assessment report, or some other type of organizational document and disseminated to the appropriate individuals. The document should be reviewed at a defined frequency updated when significant changes to the system or cybersecurity threats occur.

Additional resources:

NIST Special Publication 800-30, Rev. 1
NIST Special Publication 800-39
No LIMSpec comp (organizational policy rather than system specification)

RA-5 Vulnerability scanning

This control recommends the organization conduct vulnerability scanning of its system. "Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms." These scans should occur at a defined frequency, randomly as part of organizational processes, or when new vulnerabilities have been identified. The tools employed should be standardized to detect software flaws and improper configurations using formatting checklists test procedures, while also measuring vulnerability impact. The organizations should analyze the results of these scans, remediated legitimate vulnerabilities, and share details with appropriate personnel or roles, particularly when vulnerabilities may affect other portions of the system.

Additional resources: