Question

Discuss the concepts involved in the risk management framework. no copying and pasting. answer in your own words

Answer 1

Risk Management Framework(as set up by NSIT, USA) involves concepts from these three domains:

1. Information Security (Protecting data, access to data, use of data)

2. Software Development Life Cycle (SDLC)

3. Risk Management (A management perspective dealing with assets and their explicit and implicit value)

The concepts involved in Risk management Framework are the six basic steps included in it, which are as follows:-

Step 1: Categorize

All the info system along with the information processed, information stored, and information transmitted by that system is categorised on the basis of an impact analysis. Here the vested party(s) is/are identified.

Step 2: Select

Following categorisation, an initial set of baseline security controls is set up for the information system . These controls are specifically tailored and they supplement the security control baseline. This baseline is as needed, on the basis of an organizational assessment done for risk and local conditions. Thus, after this step, if there are any overlays applying to the system, they also get added.

Step 3: Implementation

Here Step 1 and 2 security controls are applied.

Step 4: Assessment

In this step, a third party entity will assess the controls. It will also verify that the controls get properly applied to the system in question.

Step 5: Authorization

Here the information system is usually granted (or the opposite)/ denied an Authority to Operate (ATO). A major fact to note here is that in some cases it may be postponed, allowing time for certain items to be fixed. This Authority to Operate(ATO) is based on the report from step 4 Assessment.

Step 6: Monitoring

Here the security controls in the information system(from all previous steps) are monitored in a pre-planned fashion . This planning ideally should be well documented earlier in the process. In Industry practice usually ATO is good for 3 years, following which every 3 years this whole process needs to be repeated.