Key Person Dependency Lack of Strong Passwords Inadequate Safeguards on Sensitive Data Inadequate Access Control Inadvertent Data Exposure/Loss Inappropriate Use of Clear Text Lack of Adequate Physical Security Natural Disaster Loss of Network Connectivity; Disaster, Construction, Contamination Hardware Failure/Service Loss Malware Social Engineering, Phishing Insecure Vendor or Custom-Developed Software Lack of Service Level Agreement External Vendors IP Spoofing or Forgery Lack of Funds Outdated Continuity of Operations Plan (COOP) for * See - expanded definitions. Once the risks pertaining to each critical asset have been identified and rated, the specific impact of any risk that rated a HIGH impact should be briefly illustrated. How much detail to include in each definition will be left to the discretion of assessment team members, and may depend on how much is known about the specific risk. Step 4: Recommendations to Mitigate Risks to Critical Assets For each risk pertaining to an asset listed in Step 3 that carries a high impact rating, the ITRA team members should develop one or more possible solutions to respond to the risk. Table E: Mitigation strategies for each risk associated with a mission critical asset. Mission Potential Risk Response* Justification for Risk Current or planned controls Critical High Impact Response actions to address risk (Options: Accept, Avoid, Mitigate, Share, Asset Required Transfer) Example: accept Asset C Risk 1 Compensating controls Control X is implemented no – in required. Risk 2 Example: accept No funding to No action required implement compensating controls Example: mitigate Plans underway to Plans underway to implement Risk 3 implement control X X Enforce control X Example: share Shared responsibility We monitor access control lists, with hosting. manage data integrity etc.
Key Person Dependency Lack of Strong Passwords Inadequate Safeguards on Sensitive Data Inadequate Access Control Inadvertent Data Exposure/Loss Inappropriate Use of Clear Text Lack of Adequate Physical Security Natural Disaster Loss of Network Connectivity; Disaster, Construction, Contamination Hardware Failure/Service Loss Malware Social Engineering, Phishing Insecure Vendor or Custom-Developed Software Lack of Service Level Agreement External Vendors IP Spoofing or Forgery Lack of Funds Outdated Continuity of Operations Plan (COOP) * See - for expanded definitions. Once the risks pertaining to each critical asset have been identified and rated, the specific impact of any risk that rated a HIGH impact should be briefly illustrated. How much detail to include in each definition will be left to the discretion of assessment team members, and may depend on how much is known about the specific risk. Step 4: Recommendations to Mitigate Risks to Critical Assets For each risk pertaining to an asset listed in Step 3 that carries a high impact rating, the ITRA team members should develop one or more possible solutions to respond to the risk. Table E: Mitigation strategies for each risk associated with a mission critical asset. Mission Critical Asset Potential High Impact Risk Response* (Options: Accept, Avoid, Mitigate, Share, Transfer) Justification for Risk Response Required Current or planned controls actions to address risk Asset C Risk 1 Example: accept Compensating controls in Control X is implemented – no required. Risk 2 Example: accept No funding to implement compensating controls No action required Risk 3 Example: mitigate Plans underway to implement control X Plans underway to implement X Enforce control X Example: share Shared responsibility with hosting. We monitor access control lists, manage data integrity etc.