If we were to look at applying the risk process,
as we saw before, it would involve framing of risk,
assessing, responding, and monitoring.
When we think about the framing, this central activity,
risk management must always be conducted in alignment with the goals,
mission, and culture of the organization,
so this requires the communication with senior management to
understand the attitude of the organization toward risk.
Some organizations by their very nature are adverse to risk and avoid any
risk where other organizations have a strong risk tolerance.
That means that they can go beyond the risk appetite and they can
consider new and different ways of engaging business.
Framing risk is also part of a communication strategy to make
sure that we are clear and concise with our communication and
we're not using technical jargon, but we're using service language.
We shouldn't focus on a singular technology when we're framing risk,
we should think about an architectural 30,000‑foot view,
and we need to make sure that we have the ability to be adaptable
and to think about the reconsideration of framing of risk based
upon environmental changes and threats.
Some risk methodologies break risk assessment into two separate areas,
the idea of risk identification and risk assessment.
However,
we're following the NIST approach here and we're combining the two
of these processes into the assessment space.
When we say that we are going to assess risks,
were actually estimating and prioritizing risk to
organizational operations including the mission,
the function, the image,
the reputation that is going to help us think about
how we actually do the assessment.
This would include the idea of threat and vulnerability analysis
that would consider things like likelihood and impact of particular
threats in the operational environment.
The fourth space inside of risk management is to continually monitor.
The monitoring allows us to detect new vulnerabilities,
discover new threats that are emergent,
and to look at the asset value change along with laws and
regulations that may also change in our environment.
How does the organization respond and what is the organization's posture to
these risks would also be included when we think of monitoring.
It's also important to remember that it's really not a linear approach and
these bidirectional arrows help us to think about the idea that where we are
inside of our risk management process is going to be wholly dependent upon
what the business requirements are.