AFI 31-101 Chapter 3 paragraph 3 5 IDRMP Process.docx

3.5. Process Overview. The risk management process model from AFI 10-245 is illustrated in Figure 3.1. The IDRMP has four main components: (1) the risk assessment (as described above); (2) the risk tolerance decision; (3) COA determination; and (4) decision and implementation. All four components are directly influenced by the evolving situation monitored through the IPOE cycle. As such, new information, assessments, or decisions can be assimilated into the IDRMP at any point, which may alter the execution of ID. These four components are performed in the following seven steps:

3.5.1. Step 1: Develop the Criticality Assessment (CA). The CA identifies assets worthy of protection whose loss or damage would have a negative impact on the mission. Fundamental to this evaluation is the criteria used to measure asset value or consequence of loss. Typical criteria include mission criticality, impact on national defense, replaceability, monetary value, and relative (or intrinsic) value.

3.5.2. Steps 2 and Step 3: Develop the Threat Assessment (TA) and Vulnerability Assessment (VA). Threat multiplied by Vulnerability determines the probability of loss (or damage) of the asset. Threats are generally considered in terms of adversaries and their tactics (e.g., hackers, terrorists, criminals, protestors). To know if an adversary poses a threat requires information about their operational capability, intentions, activity, operating environment and history. Vulnerabilities are weaknesses that can be exploited by an adversary because of inadequate security, lax or complacent personnel trends, vulnerable software or hardware, and insufficient security policies or procedures. (Note: Identification and evaluation of existing threats and vulnerabilities are identified during Parts 1 - 3 of the IPOE process and may be supplemented with other documents, such as AT vulnerability assessments.)

Figure 3.1. Risk Management Process Model from AFI 10-245.

3.5.3. Step 4: Develop the Risk Assessment (RA). Once all previous assessments (Criticality, Threat, and Vulnerability) are completed and studied together to provide a complete picture of the risks to an asset, the RA can be developed. A quantitative measurement of risk can be determined using the following equation:

Risk = Asset Criticality x (Threat x Vulnerability)

3.5.4. Step 5: Risk Tolerance Decision. At this point in the IDRMP, the commander may have enough data to enable an informed Risk Tolerance Decision. But if information required to assess risks is deficient, a CCIR should be developed or modified to guide the intelligence community’s collection efforts. In today’s resource-constrained environment, some risks must be accepted; however, there are risks that cannot be tolerated due to their frequency and/or severity of consequence. The Installation Commander’s intent for ID will define the level of tolerance. For risks exceeding the commander’s tolerance level, countermeasures will be developed in the next step to render these risks more acceptable (see Figure 3.2.).

Figure 3.2. Risk Tolerance Concept.

3.5.5. Step 6: Present Countermeasure Courses of Action (Countermeasure COAs). This step presents and evaluates options for reducing risks. While risks can be alleviated by reducing the asset’s criticality or mitigating the threat, eliminating vulnerabilities is the area which can have the most impact on the Installation Commander’s risk tolerance decision. At this time, the IDWG can develop various countermeasure COAs to remove or mitigate vulnerabilities and reduce unacceptable risks. An estimate of risk reduction (i.e., “benefit” of risk reduction) can be prepared, along with the showing the costs associated with COA implementation.

3.5.6. Step 7: Decision and Implementation. This is the most important step in the IDRMP. During this step, the Installation Commander selects the COA(s) that will bring the risks within his/her tolerance level, and directs resources to implement the decision. Closely tied with the Decision and Implementation step is Continuous Assessment. This feedback loop posits that risk management is not an event or tangible product, but rather a continuous cycle. The implementation of countermeasure COAs will sometimes change the installation’s risk posture in unexpected or unintended ways. By immediately identifying changes to the installation’s critical assets, threats and vulnerabilities, decision-makers can continually refine the installation’s risk posture.

image1.emf image2.emf