Organization Wide Risk Management

Question 1

NIST 800-37 vs NIST 800-39

Answer 1

NIST 800-37 - applying the RMF

NIST 800-39 - Managing Risk

Question 2

Holistic Approach to risk management

Answer 2

Look at it as a whole - management of risk at both enterprise level and system level

Areas of focus

• Goals/mission of organization
• Relationships between the mission and business processes
• Information system supporting the business processes/mission

Question 3

What are security controls?

Answer 3

processes and techniques put in place to mitigate risks

Security controls must account for

• Business impacts
• Risks
• AO acceptance
• Allocating security resources
• consideration of risk types - different types of risk need different types of protection

Question 4

Organizational Risks - 1

Answer 4

established by the enterprise, information security requirements - considered as important and critical as other functional requirements

balance must be obtained when managing organizational risks from all sources

Question 5

Organizational Risks - 2

Answer 5

operation and use of information systems - must have adequate resources to minimize risk (financial and human)

Question 6

Benefits of Organizational Risk Management

Answer 6

• prioritize requirements and allocation of resources
• Develop continuous and cost effective solutions to problems
• Consolidate and reform solutions to simplify mgmt and enhance interoperability and communication
• Ensure concerns are integrated into architecture, acquisition process, and SDLC (save time and money)

Question 7

Managing Risk - objective and goal

Answer 7

objective - Risk mgmt program adopts atmosphere where risk from systems are considered within structure of enterprise architecture and all phases of the SDLC

goal - enable organization to conduct its day to day operations and achieve its missions within secure environment alongside with risks

Question 8

What is Security Risk Management?

Answer 8

Process - manage risk to operation resulting from use of information

Question 9

Recognizing Responsibility

Answer 9

All hands approach - everyone has a role in managing risk

Question 10

Risk Management for Organization

Answer 10

accomplish exceptional security position given organization’s mission/goals

Question 11

Risk Mgmt for Information Systems

Answer 11

Protect information system from cyber attacks

Question 12

FEA

Answer 12

Federal Enterprise Architecture - facilitate efforts ensuring federal govt mission and business processes are market based and help improve citizen services

Question 13

Why have Assessor Independence

Answer 13

unbiased of assessment, AO receives most objective info