AND THE NATION his appendix provides: (i) a description of potentially useful inputs to the risk determination task including considerations for uncertainty of determinations; (ii) exemplary assessment scales for assessing the levels of risk; (iii) tables for describing content (i.e.
data inputs) for adversarial and non-adversarial risk determinations; and (iv) templates for summarizing and documenting the results of the risk determination Task 2-6. The assessment scales in this appendix can be used as a starting point with appropriate tailoring to adjust for any organization-specific conditions. Table I-5 (adversarial risk) and Table I-7 (non-adversarial risk) are outputs from Task 2-6. TABLE I-1: INPUTS â RISK Description Provided To Tier 1 Tier 2 Tier 3 From Tier 1 (Organization level) – Sources of risk and uncertainty information identified for organization-wide use (e.g.
specific information that may be useful in determining likelihoods such as adversary capabilities
intent
and targeting objectives). – Guidance on organization-wide levels of risk (including uncertainty) needing no further consideration. – Criteria for uncertainty determinations. – List of high-risk events from previous risk assessments. – Assessment scale for assessing the level of risk as a combination of likelihood and impact
annotated by the organization
if necessary. (Table I-2) – Assessment scale for assessing level of risk
annotated by the organization
if necessary. (Table I-3) No Yes Yes If not provided by Tier 2 From Tier 2: (Mission/business process level) – Risk-related information and guidance specific to Tier 2 (e.g.
risk and uncertainty information related to mission/business processes
EA segments
common infrastructure
support services
common controls
and external dependencies). Yes Via RAR Yes Via Peer Sharing Yes From Tier 3: (Information system level) – Risk-related information and guidance specific to Tier 3 (e.g.
likelihood information affecting information systems
information technologies
information system components
applications
networks
environments of operation). Yes Via RAR Yes Via RAR Yes Via Peer Sharing TABLE I-2: ASSESSMENT SCALE â LEVEL OF RISK (COMBINATION OF LIKELIHOOD AND IMPACT) Likelihood (Threat Event Occurs and Results in Adverse Impact) Level of Impact Very Low Low Moderate High Very High Very High Very Low Low Moderate High Very High High Very Low Low Moderate High Very High Moderate Very Low Low Moderate Moderate High Low Very Low Low Low Low Moderate Very Low Very Low Very Low Very Low Low Low T
Menu
