Appendix C: Formal Mathematical Statement of the Privacy Risk Model 1011 1012 1013 In this document, privacy risk is by: 1014 1015 Privacy Risk = Likelihood of a x Impact of problematic data problematic data action action 1016 1017 1018 If this is true for each data action in an information system, then the unmitigated privacy 1019 risk for an entire system, is given by 1020 1021 1022 where 1023 is the likelihood of privacy problem occurring in data action 1024 is the impact of privacy problem on the agency if it results from data action 1025 1026 is the set of all possible data actions 1027 is the set of all possible privacy problems. 1028 Mitigated, or residual, agency privacy risk for a system, is given by 1029 1030 where 1031 is the reduction in likelihood of privacy problem occurring in data action by employing control 1032 is the reduction in impact of privacy problem on the agency if it 1033 results from data action by employing control 1034 1035 The residual risk calculation implies that, for any data action, a control can reduce 1036 the likelihood of a privacy problem, the impact of that privacy problem should it occur, 1037 or both. While controls are not the focus of this document, this outcome is sufficiently 1038 important to address here. When determining controls, the agency may be able to 1039 dynamically reduce privacy risk through a single control that reduces both likelihood and 1040 impact and, potentially, does so in multiple data actions. 1041
1011 Appendix C: Formal Mathematical Statement of the Privacy Risk Model 1012 1013 In this document, privacy risk is by: 1014 1015 Privacy Risk = Likelihood of a x Impact of problematic data 1016 1017 1018 1019 1020 1021 problematic data action action If this is true for each data action in an information system, then the unmitigated privacy risk for an entire system, is given by 1022 where 1023 1024 1025 1026 1027 is the likelihood of privacy problem occurring in data action is the impact of privacy problem on the agency if it results from data action is the set of all possible data actions is the set of all possible privacy problems. 1028 Mitigated, or residual, agency privacy risk for a system, is given by 1029 1030 where 1031 1032 1033 1034 is the reduction in likelihood of privacy problem occurring in data action by employing control is the reduction in impact of privacy problem on the agency if it results from data action by employing control 1035 The residual risk calculation implies that, for any data action, a control can reduce 1036 the likelihood of a privacy problem, the impact of that privacy problem should it occur, 1037 or both. While controls are not the focus of this document, this outcome is sufficiently 1038 important to address here. When determining controls, the agency may be able to 1039 dynamically reduce privacy risk through a single control that reduces both likelihood and 1040 impact and, potentially, does so in multiple data actions. 1041
nistir_8062_draft.docx