Policy 7230A - Department of Administration

2.1.1.4 Likelihood Determination
Estimate the likelihood that a particular vulnerability will occur in the
face of controls that may be in place to mitigate it:
• For guidance on classification of likelihood, see section 2.1.1.a
of the Non-Mandatory Baselines.
2.1.1.5 Impact Analysis
Estimate the impact that a particular vulnerability will have if
exercised in the face of controls that may be in place to mitigate it.
• For guidance on classification of impact, see section 2.1.1.b of
the Non-Mandatory Baselines.
2.1.1.6 Risk Determination
Cross reference the determined likelihood with the determined
impact to determine the overall risk of each vulnerability. Decide if
the risk level is to be accepted and, if not, to what degree it is to be
mitigated.
• For guidance on classification of risk, see section 2.1.1.c of the
Non-Mandatory Baselines.
2.1.1.7 Controls Recommendation
Identify and evaluate additional controls that will reduce the
identified risk to acceptable levels:
• Evaluate both Technical (access control systems, firewalls,
etc.) and Non-Technical (policies and procedures) controls.
• Evaluate both Detective (those that warn of violations) and
Preventative (those that inhibit violations) controls.
• Perform a cost-benefit analysis for each control to narrow the
selection of controls to those that mitigate risk cost
effectively.
2.1.2. Perform Privacy Assessment
No applicable Non-Mandatory Procedures.
2.2. Security Planning
The following are the Non-Mandatory Procedures that support the Security Planning
section of the Default Security Requirements:
2.2.1. Create a Security Plan
Agencies should document the requirements and security controls that will be
implemented to achieve the determined security stance of the agency as a
result of risk and privacy assessment:
3