3. Risk Tiers Flashcards
Tier 1
Organization
Where enterprise institutional risk polices are articulated by the risk executive
Fundamental contexts about governance structures, larger views of risk tolerance, etc.
Defining a risk strategy for the whole organization
Tier 2
Mission and Business Process
Translates the organizational strategy defined in Tier 1 into processes the organization can use
For example, defining requirements or treating the R&D department as a separate division with its own requirements
Tier 3
Information Systems
Where controls are implemented using Tier 2 (mission / business process) requirements and categorizations
General Support System
Circular A-130 definition
Set of IT resources sharing the same management and common functionality
Major Application (Circular A-130 definition)
Set of IT resources requiring special security attention due to the harm if their CIA were compromised.
Can you create authorization boundaries from general support and major systems by considering commonality of purpose, security perimeter and ownership?
Yes
When are information system boundaries established?
in coordination with the security categorization process and before developing security plans
What happens if IS boundaries are too expansive?
The risk management process becomes unwieldy and too complex
What happens if IS boundaries are too narrow?
The number of systems that must be separately managed becomes too high, and inflates the organizational costs
What’s the goal of creating system inventories and boundaries?
Identify systems requiring protection, planning and management
Aspects are used in RMF Step 1, categorization
What defines the boundaries of a system?
The set of information resources allocated to an information system
There is a lot of flexibility in determining what an information system is composed of, and its associated boundary
If a set of information resources is identified as an information system, the resources are generally under the same direct management control
What has made boundaries more complex?
modern computing changes such as:
service-oriented architecture (SOA), cloud computing, introduced “dynamic subsystems” and “external subsystems)
3 types of authorization
single authorizing official
multiple (joint) authorizing officials
leveraging existing authorization
Single Authorizing Official
Traditional approach
A single official is both responsible and accountable for an information system
Joint Authorizing Officials
multiple officials from the same or different organizations have a shared interest in authorizing an information system
They are collectively responsible and accountable and jointly accept the risks
