# Risk Assessment Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ra/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Risk Assessment, and who is accountable for meeting those requirements. (RA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (RA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (RA-1a.1(a))
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (RA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (RA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (RA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (RA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (RA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (RA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (RA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (RA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (RA-1a.1(a))

## Procedures

The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (RA-1a.2)

## Dissemination

- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the risk assessment policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (RA-1a)
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the risk assessment procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (RA-1a)

## Policy statements

### Risk assessment (RA-3)

- Each [System owner] shall conduct a risk assessment of the system that identifies threats to and vulnerabilities in the system. (RA-3a.1)
- The risk assessment shall determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification or destruction of the system, the information it processes, stores or transmits, and any related information. (RA-3a.2)
- For a system that processes personally identifiable information, the risk assessment shall determine the likelihood and impact of adverse effects on individuals arising from that processing. (RA-3a.3)
- The [System owner] shall integrate the organization's risk management strategy, risk framing and mission or business process risk decisions into the system risk assessment. (RA-3b)
- The [System owner] shall document the risk assessment results in the [Select one: security and privacy plans; risk assessment report; [Assignment: organization-defined document]. Typical: risk assessment report]. (RA-3c)
- The [System owner] shall review the risk assessment results [Fill in: the frequency to review risk assessment results. Typical: annually]. (RA-3d)
- The [System owner] shall share the risk assessment results with [Fill in: personnel or roles to whom risk assessment results are to be disseminated. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (RA-3e)
- The [System owner] shall update the risk assessment [Fill in: the frequency to update the risk assessment. Typical: at least every three years], and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

### Risk response (RA-7)

- Each [System owner] shall respond to findings from security and privacy assessments, monitoring and audits in accordance with the organizational risk tolerance set in the risk management strategy. (RA-7)
- The [System owner] shall record each response as a remediation, a plan of action and milestones item, or a risk acceptance. (RA-7)
- A risk to an authorized system shall be accepted only by its authorizing official, after consulting the roles the risk management strategy names for that risk level. (RA-7)

### Privacy impact assessments (RA-8)

- The [System owner] shall have a privacy impact assessment conducted before developing or procuring information technology that processes personally identifiable information. (RA-8a)
- The [System owner] shall have a privacy impact assessment conducted before initiating a new collection of personally identifiable information that will be processed using information technology. (RA-8b)
- The [Senior privacy official] shall review and approve each privacy impact assessment. (RA-8)
- The [System owner] shall update the privacy impact assessment when a change to the system or the processing creates new privacy risks. (RA-8)

#### Federal systems

[Section 208(b) of the E-Government Act of 2002](https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.htm) (Pub. L. 107-347) requires agencies to conduct a privacy impact assessment before developing or procuring information technology that collects, maintains or disseminates information in identifiable form, and before initiating a new collection of such information that uses information technology and poses identical questions to 10 or more persons other than agencies, instrumentalities or employees of the Federal Government. The Chief Information Officer, or an equivalent official the agency head names, reviews each assessment, which is then made public where practicable. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, carries the requirement into agency privacy programs.

- The [System owner] shall have a privacy impact assessment conducted whenever section 208(b) of the E-Government Act of 2002 requires one. (RA-8)
- The [Senior privacy official] shall make each privacy impact assessment publicly available, where practicable, as section 208(b) requires. (RA-8)

## Review and update

- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current risk assessment policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current risk assessment policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (RA-1c.1)
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current risk assessment procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require risk assessment procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (RA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (RA-1a.1(b))