Task 2 RMF_Risk Assessment Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Risk Assessment Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)"

ii. NIST Special Publication 800-30 Revision 1, "Guide for Conducting Risk Assessments"

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

RISK ASSESSMENT PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The purpose of this Risk Assessment Plan is to provide guidance for conducting risk assessments. This plan ensures that {ACRONYM} follows and implements the NIST Special Publication 800-30 Revision 1, "Guide for Conducting Risk Assessments”.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

The following Assessment Procedures have not been allocated by NIST:

· RA-4: Risk Assessment Update

· RA-6: Technical Surveillance Countermeasures Survey

Table 1 - SP-800-53v4 Compliance Matrix

2.0 RISK ASSESSMENT POLICY AND PROCEDURES

DoD Components are automatically compliant with risk assessment policies and procedures because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

DoD has defined the personnel or roles for risk assessment policies and procedures roles as at a minimum, the ISSM and ISSO.

DoD has defined the frequency for risk assessment policies and procedures updates as annually - updated as appropriate.

3.0 SECURITY CATEGORIZATION

Security categorization describe the potential adverse impacts to {ACRONYM} operations, assets, and individuals if {ACRONYM} is comprised through a loss of confidentiality, integrity, or availability.

Has {ACRONYM} completed RMF Step 1 – System Categorization?

☐ No

☐ Yes

If Yes, are categorization results (including supporting rationale) in the security plan?

☐ No

☐ Yes

If Yes, has the security categorization decision been reviewed and approved by the authorizing official or authorizing official designated representative?

☐ No

☐ Yes

4.0 RISK ASSESSMENT

Risk assessments take into account threats, vulnerabilities, likelihood, and impact to {ACRONYM} operations and assets, individuals, other organizations, and the Nation based on the operation and use of {ACRONYM}.

{ACRONYM} will create a Risk Assessment Report (RAR) that contains an executive summary; detailed risk assessment results; and supporting appendices. A RAR Template is provided in Enclosure 1 and contains the following information:

· Executive Summary

· List the date of the risk assessment

· Summarize the purpose of the risk assessment

· Describe the scope of the risk assessment

· State whether this is an initial or subsequent risk assessment. If a subsequent risk assessment, state the circumstances that prompted the update and include a reference to the previous Risk Assessment Report

· Describe the overall level of risk (e.g., Very Low, Low, Moderate, High, or Very High)

· List the number of risks identified for each level of risk (e.g., Very Low, Low, Moderate, High, or Very High)

· Body of the Report

· Describe the purpose of the risk assessment, including questions to be answered by the assessment

· Identify assumptions and constraints

· Describe risk tolerance inputs to the risk assessment (including the range of consequences to be considered)

· Identify and describe the risk model and analytic approach; provide a reference or include as an appendix, identifying risk factors, value scales, and algorithms for combining values

· Provide a rationale for any risk-related decisions during the risk assessment process

· Describe the uncertainties within the risk assessment process and how those uncertainties influence decisions

· If the risk assessment includes organizational missions/business functions, describe the missions/functions (e.g., mission/business processes supporting the missions/functions, interconnections and dependencies among related missions/business functions, and information technology that supports the missions/business functions)

· If the risk assessment includes organizational information systems, describe the systems (e.g., missions/business functions the system is supporting, information flows to/from the systems, and dependencies on other systems, shared services, or common infrastructures)

· Summarize risk assessment results (e.g., using tables or graphs), in a form that enables decision makers to quickly understand the risk (e.g., number of threat events for different combinations of likelihood and impact, the relative proportion of threat events at different risk levels)

· Identify the time frame for which the risk assessment is valid (i.e., time frame for which the assessment is intended to support decisions)

· List the risks due to adversarial threats

· List the risks due to non-adversarial threats

· Appendices

· List references and sources of information

· List the team or individuals conducting the risk assessment including contact information

· List risk assessment details and any supporting evidence Has an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of {ACRONYM} and the information it processes, stores, or transmits been performed?

☐ No

☐ Yes

Has the Risk Assessment Report been created?

☐ No

☐ Yes

Have the risk assessment results been updated upon re-accreditation or whenever there are significant changes to {ACRONYM} or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of {ACRONYM}?

☐ No

☐ Yes

Has the Risk Assessment Report been disseminated to the ISSM, ISSO, AO, and PM?

☐ No

☐ Yes

5.0 VULNERABILITY SCANNING

Vulnerability scanning includes, for example: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms. {ACRONYM} will utilize, at a minimum, the following DoD provided tools for vulnerability scanning:

· Assured Compliance Assessment Solution (ACAS)

· Security Content Automation Protocol (SCAP) {ACRONYM} will follow the DISA process for performing ACAS scans, which is located at https://patches.csd.disa.mil/CollectionInfo.aspx?id=535.

{ACRONYM} will follow the DISA process for performing SCAP scans, which is located at http://iase.disa.mil/stigs/scap/Pages/index.aspx.

Is {ACRONYM} utilizing ACAS and SCAP for vulnerability scanning?

☐ No

☐ Yes

If Yes, is ACAS and SCAP configured to use the latest DISA-provided policies and updates?

☐ No

☐ Yes

If Yes, is ACAS and SCAP configured to use privileged accounts for scanning?

☐ No

☐ Yes

The following figure defines the overarching vulnerability scanning process and provides the following information:

· corrective actions when information about {ACRONYM} is discoverable by adversaries

· ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs

· identify and report new vulnerabilities

· remediation of legitimate vulnerabilities Vulnerability scanning will occur every 30/90 days and the results shared with at a minimum, the ISSM and ISSO.

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSM and ISSO.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low NIST SP 800-30 meets the DoD requirements for risk assessment policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoDi 8510.01 which adopts NIST SP 800-30 as the DoD risk assessment policy.

DoD has defined the frequency as annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed categorizes information and the information system in accordance with CNSSI 1253 and applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

Section 3

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the risk assessment report to ensure the organization being inspected/assessed documents risk assessment results in the risk assessment report.

DoD has defined the document as a risk assessment report.

Section 4

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the document as a risk assessment report.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the record of reviews to ensure the organization being inspected/assessed reviews risk assessment results upon re-accreditation.

DoD has defined the frequency as upon re-accreditation.

Section 4

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as upon re-accreditation.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed disseminates the risk assessment results to the ISSM, ISSO, AO, and PM.

DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.

Section 4

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as the ISSM, ISSO, AO, and PM.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines historical versions of the risk assessment as well as records of changes to the system to ensure the organization being inspected/assessed updates the risk assessment upon re-accreditation or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

DoD has defined the frequency as upon re-accreditation.

Section 4

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as upon re-accreditation.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment will:

1. If the inspected organization is using the DoD provided enterprise scanning tool, compliance with this control is complete.

2. Validate the identified tool in use by the inspected organization is able to maintain current up to date information system vulnerability data.

Section 5

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as prior to running scans.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented corrective actions to ensure the organization being inspected/assessed defines the corrective actions when information about the information system is discoverable by adversaries.

DoD has determined the corrective actions are not appropriate to define at the Enterprise level.

Section 5

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented vulnerability scanning activities to ensure the organization being inspected/assessed defines the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.

DoD has determined the vulnerability scanning activities are not appropriate to define at the Enterprise level.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to implement privileged access authorization to all information systems and infrastructure components for selected vulnerability scanning activities defined in RA-5 (5), CCI 2906.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1067.

DoD has defined the information system components as all information systems and infrastructure components.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the information system components as all information systems and infrastructure components.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the organization's vulnerability scanning procedures and results for the 90 days preceding the inspection/assessment.

If the system in question has not been operational for more than 90 days the organization will provide all available scan(s).

Section 5

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines random vulnerability process documentation (if applicable) to validate the organization has clearly defined and documented a process for conducting random vulnerability scans on the information system and hosted applications.

If the organization being inspected/assessed has determined they have no requirement for random scanning, there is no requirement for a process.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the vulnerability scanning results every 30 days or as directed by an authorative source (e.g. IAVM, CTOs, DTMs, STIGs) to verify compliance with the organization being inspected/assessed random vulnerability scanning process.

DoD has defined the frequency as every 30 days or as directed by an authorative source (e.g. IAVM, CTOs, DTMs, STIGs).

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines audit records to validate the organization is taking action to remediate legitimate vulnerabilities within the required response times (IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).

The organization conducting the inspection/assessment may conduct independent vulnerability scans to compare those scan results with audit records of remediation actions.

DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the response times as IAW an authoritative source (e.g. IAVM, CTOs, DTMs).

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed shares information obtained from the vulnerability scanning process and security control assessments with at a minimum, the ISSM and ISSO to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

DoD has defined the personnel or roles as at a minimum, the ISSO and ISSM.

Section 5

DoD has determined the locations are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the frequency is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

ENCLOSURE 1 – RISK ASSESSMENT REPORT TEMPLATE

This report is focused on risk assessment of non-compliant (NC) security controls and addresses vulnerabilities displayed in the Security Assessment Report (SAR) after the security control assessment has been completed by the Security Control Assessor (SCA). All NC security controls must be subjected to a risk assessment that considers multiple factors in assigning a residual risk level to each NC security control. The individual risk levels are then used to inform the SCA’s recommendation (i.e., SAR executive summary) to the Authorizing Official on acceptance of the cybersecurity risk of operating the system.

FOR OFFICIAL USE ONLY 15

image2.emf

Microsoft_Visio_Drawing.vsdx image3.emf

DoD RAR_Final_05_02_14.xlsx RAR of NC Security Controls

DoD Risk Assessment Report (RAR) of Non-Compliant (NC) Security Controls

(1) System Name (2) System Acronym (3) DoD Component (4) System Identification (5) System Type

<Insert System Name Here>

(6) Authorizing Official (8) Authorization Status (9) Assessment Completion Date (10) Period Covered (11) Last Update

Authorization Date Authorization Termination Date

(7) Security Controls Assessor (SCA) and/or SCA Representative (12) System Categorization (13) Stakeholder Information

Confidentiality Integrity Availability ISO:

ISSM:

Other:

(14) Executive Summary:

(15) Summary of Risk Assessment Results:

(15a) Risk Determination

Likelihood Impact

Very Low Low Moderate High Very High Legend

Very High I C,A Very High

High High

Moderate Moderate

Low Low

Very Low Very Low

(15b) Non-Compliant Security Controls by Risk Level (Before Mitigation) (15c) Non-Compliant Security Controls by Risk Level (After Proposed Mitigation)

Security Objectives Impact Security Objectives Impact

Very Low Low Moderate High Very High Very Low Low Moderate High Very High

2 3 6 4 2 5 8 4 0 0

(16) Specific Vulnerabilities

(From SAR) (16b) Security Objectives (C-I-A) (16c) Severity or Pervasiveness

(VL-VH)

(16d) Relevance of Threat

(VL - VH)

(16e) Likelihood (Cells 16d & 16f)

(VL - VH)

(16f) Impact

(VL - VH)

(Cells 16f & 16g)

(VL -VH)

(16i) Proposed Mitigations (From POA&M) (16j) Residual Risk (After Proposed Mitigations) (16k) Recommendations (16l)

Page &P of &N &D

RAR Instructions

DoD Risk Assessment Report of Non-Compliant (NC) Security Controls Instructions

Please find below instructions for completing the DoD Risk Assessment Report of non-compliant security controls. The report is to communicate risk assessment results to organizational decision makers to support risk responses. This report also addresses vulnerabilities displayed in the SAR after the security control assessment has been completed by the SCA. All NC security controls must be subjected to a risk assessment that considers multiple factors in assigning a residual risk level to each NC security control. The individual risk levels are then used to inform the SCA’s recommendation (i.e., SAR executive summary) to the Authorizing Official on acceptance of the cybersecurity risk of operating the system.

Item # Field Name Field Description/Instructions

Header

1 System Name Full descriptive name of the system and system version number.

Example: Agency Billing System

Information can be obtained from the Security Plan (System Name).

Example: ABS

Information can be obtained from the Security Plan (Acronym).

3 DoD Component Parent or governing Component that manages, owns, and/or controls the system.

Select from the drop down box the correct DoD Component, Combatant Command, Service, or Agency that owns the IS or PIT system.

Drop Down List to include all CC/S/As

Information can be obtained from the Security Plan (DoD Component).

4 System Identification Unique system identifier (typically a number or code) used by the DoD Component to uniquely identify the system. This is usually the DITPR ID.

Example: 63221

Information can be obtained from the Security Plan (System Identification).

5 System Type Identify the DoD information system type.

Drop Down:

IS Major Application IS Enclave Platform IT System

Information can be obtained from the Security Plan (System Type).

6 Authorizing Official (AO) The name of AO for whom the RAR was prepared.

Information can be obtained from the Security Plan (RMF POCs, Member Names, and Contact Information Table).

7 SCA or SCA Representative The name of the individual serving as the Security Controls Assessor (SCA) or SCA Representative for the system.

Information can be obtained from the Security Plan (RMF POCs, Member Names, and Contact Information Table).

8 Authorization Status Choose from the drop down list the authorization decision for the information system:

Not yet authorized

ATO

ATO with Conditions

IATT

DATO

Information can be obtained from the Security Plan (Authorization Status).

9 Assessment Completion Date List the date the security control assessment of the system was completed.

10 Period Covered If the system is/was authorized, list the authorization date and the authorization termination date (ATD), even if they have expired.

Example:

Authorization Date: 23-Sep-05

ATD: 23-Sep-07

Information can be obtained from the SAR (Period Covered).

11 Last Update List the date of the last change that occurred on the security assessment report. This is primarily driven by updates to the security controls and their associated status, or by documenting results of periodic reviews.

Example:

24-Dec-05

12 System Categorization Select appropriate security categorization impact levels [Drop Down] Low Moderate High

Link to CNSSI 1253 for description

Information can be obtained from the Security Plan (Confidentiality/ Integrity/ Availability).

13 Stakeholder Information Identify the stakeholders who were consulted during this assessment (e.g., Information System Owner (ISO), Information System Security Manager (ISSM), other stakeholders as appropriate). Include the following type of information for each role:

Name/Rank/Grade:

Organization/Office:

Email:

Phone:

Main Template

14 Executive Summary The RAR executive summary is developed as a coordinated effort between the PM/SM, and ISO using vulnerabilities identified by the SCA in the SAR. PM/SM in coordination with the ISO must determine and document in the RAR an assessment of overall system cybersecurity risk (Very Low, Low, Moderate, High, or Very High), and identify the key drivers for that assessment.

PM/SM in coordination with the ISO provides an AO with a synopsis of the assessment report focusing on the security controls assessment to include overall description of security posture of the IS or PIT systems and an overall recommendation for authorization of the IS or PIT systems.

Include recommendations for correcting or accepting risk due to specific vulnerabilities, as well as stipulating implementation of any of the proposed mitigations.

15 Summary of Risk Assessment Results 15a. Risk Determination Use this table to plot the highest risk non-compliant security control (or enhancements) for each security objective (C-I-A). With regard to the aggregation of risk (multiple security controls plotting to similar risk), plot the security control with the highest risk to establish the upper bound for recording overall risk for each security objective. Indicate a C - I - A within the appropriate box as per the example. Note: When no non-compliant security control exist for a security objective, that security objective will not be mapped. When multiple security controls receive a risk rating of High or Very High, each is briefly discussed, as related to its assigned security objective, in the Executive Summary to the AO.

15b. Non-Compliant Security Controls by Risk Level (Before Mitigation) Identify the number of all non-compliant security controls (and enhancements) at each risk level, before any proposed mitigations are applied (i.e., what the risk is in the system’s current state).

15c. Non-Compliant Security Controls by Risk Level (After Proposed Mitigation) Identify the number of all non-compliant security controls (and enhancements) at each risk level, after the proposed mitigations (i.e., what the risk would be if the PM implemented the listed proposed mitigations).

16 Specific Vulnerability 16a. Non-Compliant Security Controls List the applicable security control/enhancement number associated with the vulnerability. If more than one security control is associated with a vulnerability, list all security controls on separate lines and repeat the vulnerability description.

16b. Vulnerability Description (From SAR) Describe the vulnerability associated with each non-compliant security control.

Information can be obtained from the SAR (Vulnerability Summary).

16c. Security Objectives (C-I-A) Identify the security objective (Confidentiality, Integrity, and/or Availability) supported by the security control/enhancement (reference CNSSI No. 1253, Table D-2, Additional Security Control Information) by using C, I, or A. In some cases security controls may support multiple security objectives and should be separated by a hyphen "-" (e.g., C-I or C-I-A or C-A or I-A).

16d. Severity or Pervasiveness The severity value is assigned to a vulnerability, but a pervasiveness value is assigned to predisposing conditions. The PM/SM estimates this value based on a comparison of the raw findings during the security controls assessment and the effectiveness of mitigation actions (see Table 3 on the RMF KS page "Model for Assessing Residual Risk Level for Non-Compliant Security Controls"). If mitigations are completely effective, this value is non-existent and the remainder of the cells in the row would contain no values, as there can be no likelihood of exploitation, impact, or risk. This value is informed by assessment at the control correlation identifier (CCI) level. If a control has a STIG or SRG associated through CCIs, the vulnerabilities identified by STIG or SRG assessments will be used to inform the value in this column for the security control, but there isn’t a one-to-one correlation between raw STIG CAT values (i.e., CAT I, CAT II, CAT III) and this value.

Identify the severity or pervasiveness as one of the following:

Very Low (VL) Low (L) Moderate (M) High (H) Very High (VH)

16e. Relevance of Threat Determine the relevance of the threat by identifying potential threat events, relevance of the events, and threat sources that could initiate the events. If the relevance of the threat does not meet the organization’s criteria for further consideration, do not complete the remaining columns, as there is no risk. This factor is based on the risk assessor’s estimate after considering a combination of an adversarial threat source’s capability, intent, and targeting or a non-adversarial threat source’s range of effects based on available evidence, experience, and expert judgment. This factor takes into consideration multiple NIST SP 800-30 risk factors; that is, consider which threat sources may initiate which threat events against the vulnerability or predisposing condition. There is a many-to-many relationship between these risk factors. While this model simplifies this relationship and assignment of a value, it may be advantageous for risk assessors to review NIST SP 800-30 to understand the factors, examine the exemplar lists of these factors, and separately document how these relationships were examined and measured. (See Table 4 on the RMF KS page "Model for Assessing Residual Risk Level for Non-Compliant Security Controls" for descriptions of values assigned to threat relevance.)

Identify the relevance of threat as one of the following:

Very Low (VL) Low (L) Moderate (M) High (H) Very High (VH)

16f. Likelihood (Cells 16d & 16e) Determine the likelihood a threat event will be initiated or occur and result in adverse impacts (see Table 5 on the RMF KS page "Model for Assessing Residual Risk Level for Non-Compliant Security Controls" for likelihood values).

Likelihood is a combination of likelihood of attack initiation/ occurrence and likelihood that initiated attack succeeds or the threat even results in adverse impact. If resource constraints allow, risk assessors may reference NIST SP 800-30 for guidance on determining this value (i.e., could use another 5x5 matrix to plot the two factors and determine the overall likelihood.) However, as the likelihood is summarized in this model, risk assessors assign a value by comparing the results of 16d. "Severity or Pervasiveness" with 16e. "Relevance of Threat." The factors from these two columns are plotted on a 5x5 matrix, and the intersection on the matrix indicates the value for likelihood (see tab "RAR Likelihood & Risk Matrices" for the 5x5 matrix).

Identify the likelihood as one of the following:

Very Low (VL) Low (L) Moderate (M) High (H) Very High (VH)

16g. Impact Determine the adverse impact (i.e., potential harm to organizational operations, organizational assets, individuals, other organizations, or the Nation) from the threat event. Risk assessors may consider the Concept of Operations, system description, User Representative input, etc. (See Table 6 on the RMF KS page "Model for Assessing Residual Risk Level for Non-Compliant Security Controls" for descriptions of the values assigned to impact.)

Identify the impact as one of the following:

Very Low (VL) Low (L) Moderate (M) High (H) Very High (VH)

16h. Impact Description Describe the operational impact due to the non-compliant security control.

16i. Risk (Cells 16f & 16g) Determine the level of risk as a combination of likelihood and impact (see Table 7 on the RMF KS page "Model for Assessing Residual Risk Level for Non-Compliant Security Controls" for descriptions of values assigned to risk). Risk assessors assign a value by comparing the results of 16f. "Likelihood" with 16g. "Impact." The factors from these columns are plotted on a 5x5 matrix, and the intersection on the matrix indicates the value for risk (see tab "RAR Likelihood & Risk Matrices" for the 5x5 matrix).

Identify the risk as one of the following:

Very Low (VL) Low (L) Moderate (M) High (H) Very High (VH)

16j. Proposed Mitigations List the proposed mitigations that, if implemented, will reduce the risk.

16k. Residual Risk (After Initial Mitigation) Indicate the risk level expected after the initial mitigations are implemented. This mitigations are provided in the POA&M.

16l. Recommendations The PM/SM lists the recommendations addressing actions that will at a minimum reduce the High and Very High Risk non-compliant security controls to a Moderate Risk.

Page &P of &N &D

RAR Likelihood & Risk Matrices

Combination of Vulnerability Severity/Predisposing Condition Pervasiveness and Threat Relevance

Relevance of Threat Vulnerability Severity/Predisposing Condition Pervasiveness

Very Low Low Moderate High Very High

Very High Very Low Low Moderate High Very High

High Very Low Low Moderate High Very High

Moderate Very Low Low Moderate Moderate High

Low Very Low Low Low Low Moderate

Very Low Very Low Very Low Low Low Low

Combination of Likelihood and Impact

Very Low Low Moderate High Very High

Very High Very Low Low Moderate High Very High

High Very Low Low Moderate High Very High

Moderate Very Low Low Moderate Moderate High

Low Very Low Low Low Low Moderate

Very Low Very Low Very Low Low Low Low

RAR Executive Summary

DoD Risk Assessment Report (RAR) of Non-Compliant Security Controls

(1) System Name (2) System Acronym (3) DoD Component (4) System Identification (5) System Type

<Insert System Name Here>

(6) Authorizing Official (8) Authorization Status (9) Assessment Completion Date (10) Period Covered (11) Last Update

Authorization Date Authorization Termination Date

(7) Security Controls Assessor (SCA) and/or SCA Representative (12) System Categorization (13) Stakeholder Information

Confidentiality Integrity Availability ISO:

ISSM:

Other:

(14) Executive Summary:

(15) Summary of Risk Assessment Results:

(15a) Risk Determination

Likelihood Impact

Very Low Low Moderate High Very High Legend

Very High I C,A Very High

High High

Moderate Moderate

Low Low

Very Low Very Low

(15b) Non-Compliant Security Controls by Risk Level (Before Mitigation) (15c) Non-Compliant Security Controls by Risk Level (After Proposed Mitigation)

Security Objectives Impact Security Objectives Impact

Very Low Low Moderate High Very High Very Low Low Moderate High Very High

2 3 6 4 2 5 8 4 0 0

Page &P of &N &D image1.gif