4.1 Initial Risk NIST SP and Initial risk assessment documentation records threats, Task TBD by Assessment vulnerabilities (weaknesses), existing controls, Order Task Documentation probability, impact, and risk identified during a Reference COR Order discussion with key system personnel (e.g., System NIST site Owner, Authorizing Official, Information System for best Security Officer, Security Administrator, User, etc.). practices. This effort relies on knowledge of expert system personnel. Vulnerabilities identified during this process should be rolled into the independent assessment. If completed during system development efforts, modifications to the system should be made as applicable. 4.2 Business Impact NIST SP The Business Impact Analysis (BIA) is an analysis of Task TBD by Analysis an information technology (IT) system’s requirements, NIST Task processes, and interdependencies used to characterize COR Order system contingency requirements and priorities in the Appendix B event of a significant disruption. 4.2 Contingency Plan NIST SP Contingency plans provide thorough procedures and Task TBD by technical measures that can enable a system to be NIST Order Task recovered quickly and effectively following a service COR Order disruption or disaster. Appendix A
4.1 Initial Risk Assessment Documentation NIST SP and Initial risk assessment documentation records threats, vulnerabilities (weaknesses), existing controls, probability, impact, and risk identified during a discussion with key system personnel (e.g., System Owner, Authorizing Official, Information System Security Officer, Security Administrator, User, etc.). This effort relies on knowledge of expert system personnel. Vulnerabilities identified during this process should be rolled into the independent assessment. If completed during system development efforts, modifications to the system should be made as applicable. Reference NIST site for best practices. Task Order COR TBD by Task Order 4.2 Business Impact Analysis NIST SP The Business Impact Analysis (BIA) is an analysis of an information technology (IT) system’s requirements, processes, and interdependencies used to characterize system contingency requirements and priorities in the event of a significant disruption. NIST Appendix B Task COR TBD by Task Order 4.2 Contingency Plan NIST SP Contingency plans provide thorough procedures and technical measures that can enable a system to be recovered quickly and effectively following a service disruption or disaster. NIST Appendix A Task Order COR TBD by Task Order