RA-3—Risk Assessment

>Control Description

Conduct a risk assessment, including:

Identifying threats to and vulnerabilities in the system;

Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and

Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;

Document risk assessment results in ☑security and privacy plans; risk assessment report; [Assignment: organization-defined document];

Review risk assessment results ⚙organization-defined frequency;

Disseminate risk assessment results to ⚙organization-defined personnel or roles; and

Update the risk assessment ⚙organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

>Related Controls

Ask AI

Configure your API key to use AI features.