3.5.3 Residual Risk NIST SP The residual risk statement identifies the final Task TBD by Statement determination of the level of risk to organizational Reference Order Task operations and assets, individuals, other organizations, NIST site COR Order and the Nation resulting from the operation and use of for best the information system. These are the risks that remain practices. after all of the mitigation activities have been done on the system. 3.5.3 Briefing (slides Briefing materials and slides to support the Monitoring Task TBD by and meeting Strategy Step Order Task support) COR Order 3.5.4 Risk Acceptance NIST SP The risk acceptance recommendation takes into account Task TBD by Recommendation the residual risk of the system. It is a recommendation Reference Order Task to the authorizing authority on whether the level of NIST site COR Order residual risk is commensurate with the mission needs for best for the system. practices. 3.5.4 Briefing (slides Briefing materials and slides to support the Monitoring Task TBD by and meeting Strategy Step Order Task support) COR Order 3.6.1 Impact Assessment NIST SP The impact assessment documents proposed or actual Task TBD by changes to an information system or its environment of Reference Order Task operation and the assessment of the potential impact NIST site COR Order those changes may have on the security state of the for best system or the organization. This is an important aspect practices. of security control monitoring and maintaining the security authorization over time.
3.5.3 Residual Risk Statement NIST SP The residual risk statement identifies the final determination of the level of risk to organizational operations and assets, individuals, other organizations, and the Nation resulting from the operation and use of the information system. These are the risks that remain after all of the mitigation activities have been done on the system. Reference NIST site for best practices. Task Order COR TBD by Task Order 3.5.3 Briefing (slides and meeting support) Briefing materials and slides to support the Monitoring Strategy Step Task Order COR TBD by Task Order 3.5.4 Risk Acceptance Recommendation NIST SP The risk acceptance recommendation takes into account the residual risk of the system. It is a recommendation to the authorizing authority on whether the level of residual risk is commensurate with the mission needs for the system. Reference NIST site for best practices. Task Order COR TBD by Task Order 3.5.4 Briefing (slides and meeting support) Briefing materials and slides to support the Monitoring Strategy Step Task Order COR TBD by Task Order 3.6.1 Impact Assessment NIST SP The impact assessment documents proposed or actual changes to an information system or its environment of operation and the assessment of the potential impact those changes may have on the security state of the system or the organization. This is an important aspect of security control monitoring and maintaining the security authorization over time. Reference NIST site for best practices. Task Order COR TBD by Task Order