Policy 7230A - Department of Administration

2. Assessment & Planning
These Assessment and Planning Non-Mandatory Baselines support the Enterprise Security
Policy (ITEC 7230 Rev 1).
2
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
2. Assessment & Security Planning
2.1. Risk and Privacy Assessment
2.1.1. Perform Risk Assessment (7 sets) (3 sets)
2.1.2. Perform Privacy Assessment (7 sets) (3 sets)
2.2. Security Planning
2.2.1. Create a Security Plan (5 sets) (3 sets)
2.3. Maintain Records
2.1. Risk and Privacy Assessment
The following are the Non-Mandatory Baselines that support the Risk and Privacy
Assessment section of the Default Security Requirements:
2.1.1. Perform Risk Assessment
Agencies should determine the amount and nature of risk to which a system is
exposed to establish the amount of risk to be mitigated and to better define
the appropriate security controls required to mitigate that risk:
2.1.1.a Threat Likelihood Classification Scheme
• High likelihood indicates the threat-source is motivated and
capable and controls are insufficient or ineffective.
• Medium likelihood indicates the threat-source is motivated
and capable but that controls may be sufficient and effective.
• Low likelihood indicates the threats-source is motivated and
capable but that controls are sufficient and effective OR the
threat-source is unmotivated or incapable.
2.1.1.b Threat Impact Classification Scheme
• High impact indicates significant loss of assets or resources,
significant damage to the organizational mission, or serious
human injury or death.
• Medium impact indicates moderate loss of assets or
resources, moderate damage to the organizational mission, or
human injury.
• Low impact indicates minimal loss of assets or resources, or
minimal damage to the organizational mission.
2.1.1.c Risk Classification Scheme
• Very High risk constitutes high likelihood and high impact.
Risks of this nature have the strongest need for corrective
action and resolution should be considered an emergency
action.