- [Instructor] Risk management is a complex topic,
and fortunately organizations don't need
to design their own risk management processes
from the ground up.
Risk management frameworks
provide proven, time-tested techniques
for performing enterprise risk management.
One of the most widely used
risk management frameworks was developed
by the National Institute of Standards and Technology,
a US federal government agency.
The NIST process is mandatory
for many government computer systems,
but private organizations have also widely adopted it
because they find it a helpful approach.
The framework is found in NIST Special Publication 800-37.
This document runs over 60 pages
and includes great detail on the framework
that is good reading for anyone involved in risk management.
The publication is available for free on NIST's website.
For our purposes,
an overview of the six steps in the process
will be more than enough to prepare for the CISSP exam.
This diagram shows the six steps involved
in risk management, according to NIST.
Before beginning the process,
the organization should gather information
from two categories.
The first set of information involves
the technology architecture
and includes reference models,
technical details,
business process information,
and information system boundaries.
The second input to the process
is organization-specific information,
including the laws, regulations, and policies that apply,
the strategy of the organization,
its priorities,
resource availability,
and supply chain information.
After gathering this information,
the organization enters step one
of the risk management framework,
where it categorizes the information system being assessed,
as well as the information that will be stored, processed,
and transmitted by the system.
This is normally done by performing an impact assessment.
In step two, the organization selects the security controls
that should be use to manage risk to the information system.
This selection is based upon
the system's categorization from step one.
The organization will likely begin
by selecting a standard baseline of controls
and then adding or subtracting specific controls
to tailor that baseline to the system's specific needs.
After selecting controls,
the organization moves to step three,
where it implements the selected controls.
Then, in step four,
the organization performs a control assessment
to determine whether the controls
were correctly implemented,
if they're operating correctly,
and whether they meet the security requirements.
After this assessment is complete,
the organization then enters step five,
where it authorizes operation of the information system.
In the federal government,
authorization is a very formal process,
where a senior government official must accept
any remaining risks.
Once a system is authorized and running,
we move to step six of the risk assessment framework,
where the organization monitors the security controls
on an ongoing basis to ensure their continued effectiveness
and respond to any environmental changes.
If this monitoring detects significant issues,
the cycle may begin anew.