Risk Management

Risk Management definition in Computer Security terms:

Acronym(s): None

Definition(s): The process of managing risks to organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system.
Source(s): FIPS 200

The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Source(s): CNSSI 4009-2015 (NIST SP 800-39)
NIST SP 800-128 (NIST SP 800-39)
NIST SP 800-137 (Adapted from FIPS 200)
NIST SP 800-161 (Adapted from CNSSI 4009)
NIST SP 800-39 (Adapted from CNSSI 4009)
NIST SP 800-53 Rev. 4 (Adapted from CNSSI 4009)
NIST SP 800-30 (NIST SP 800-39, Adapted from CNSSI 4009)

The process of selecting and implementing controls to reduce risk to a level acceptable to the organization.
Source(s): NIST SP 800-123

The on-going process of assessing the risk to IT resources and information, as part of a risk-based approach used to determine adequate security for a system, by analyzing the threats and vulnerabilities and selecting appropriate cost-effective controls to achieve and maintain an acceptable level of risk.
Source(s): NIST SP 800-16

The process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; the selection, implementation, and assessment of security controls; and the formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations.
Source(s): NIST SP 800-18 Rev. 1 (NIST SP 800-30)
NIST SP 800-34 Rev. 1 (NIST SP 800-53)

The ongoing process of assessing the risk to mission/business as part of a risk-based approach used to determine adequate security for a system by analyzing the threats and vulnerabilities and selecting appropriate, cost-effective controls to achieve and maintain an acceptable level or risk.
Source(s): NIST SP 800-27 Rev. A

The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system.
Source(s): NIST SP 800-37 Rev. 1 (Adapted from FIPS 200)
NIST SP 800-82 Rev. 2 (Adapted from FIPS 200)

The total process of identifying, controlling, and mitigating information technology related risks. It includes risk analysis; cost-benefit analysis; and the selection, implementation, test, and security evaluation of safeguards. This overall system security review considers both effectiveness and efficiency, including impact on the mission/business and constraints due to policy, regulations, and laws.
Source(s): NIST SP 800-33

The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security and privacy state of the information system.
Source(s): NIST SP 800-53A Rev. 4 (Adapted from CNSSI 4009)

Synonym(s): None

 

reference: CSRC Glossary