Framing the Risk
Leaders in the organizational tier establish the risk framework that the organization
will use to define risk assumptions, risk constraints, risk tolerances, and risk priorities.
Defining risk assumptions includes determining the likelihood that a vulnerability,
threat, or occurrence could impact the organization and what the consequences
or impact would be if it were to occur. Issues in the enterprise that restrict or slow risk
assessments, risk response, or risk monitoring are categorized as risk constraints.
Risk tolerances are those possible events or occurrences whose impacts on the organization
are acceptable; often these risks are deemed acceptable because of the
excessive cost of countering them. Finally, risk priorities are those events that must
be protected against and systems that have a reduced risk tolerance. Many organizations
prioritize system risk acceptance based on whether or not systems support
critical business or mission functions, as these systems have the lowest risk tolerance
and highest risk priority.