RA-3: Risk Assessment

Statement

• a.

  Conduct a risk assessment, including:

  • 1.

    Identifying threats to and vulnerabilities in the system;

  • 2.

    Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and

  • 3.

    Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

• b.

  Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;

• c.

  Document risk assessment results in ra-03_odp.01 ;

• d.

  Review risk assessment results frequency ;

• e.

  Disseminate risk assessment results to personnel or roles ; and

• f.

  Update the risk assessment frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

• • Guidance:

    Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F.

  • (e) Requirement:

    Include all Authorizing Officials; for JAB authorizations to include FedRAMP.