ISC2 Certified in Governance, Risk and Compliance

System-level risk decisions only make sense inside an organizational frame. This module covers how leaders set risk tolerance, how risk is framed, assessed, responded to and monitored, and how assessment methods turn threats into rated risk.

• Risk framing: assumptions, constraints, priorities
• Threat, vulnerability, likelihood and impact as used in NIST SP 800-30
• Risk response: accept, avoid, mitigate, share, transfer
• Risk tolerance and appetite statements
• Enterprise, mission and system tiers of risk
• Supply chain risk in a compliance program

You build A risk assessment of one system with ratings, responses and a stated tolerance.

Privacy has its own controls, roles and risks, and they do not always match security’s. You learn how personal data is identified and categorized, how privacy impact assessments work, and where privacy controls are selected and assessed alongside security ones.

• Personally identifiable information and where it hides
• Privacy principles and how they turn into controls
• Privacy impact assessments, start to finish
• Privacy roles and the link to security roles
• Privacy risk compared with security risk
• Privacy requirements across legal regimes

You build A privacy impact assessment for a system that stores customer records.

Controls depend on what the system is and what it holds. You prepare for risk management, draw the authorization boundary, identify the information types the system processes, and categorize the system by the harm a loss would cause.

• Preparation tasks at the organization and system level
• Drawing and defending an authorization boundary
• Describing a system: components, interfaces, data flows
• Information types and impact levels with FIPS 199 and SP 800-60
• The high-water mark and its consequences
• Registering the system and recording the categorization

You build A system description with boundary diagram, data flows and a reasoned categorization.

A baseline is a starting point, not an answer. You select a control set from SP 800-53 families, tailor it with scoping, parameters and compensating controls, add overlays, and take the selection to the people who approve it.

• Control families and how a control is written
• Baseline selection from the impact level
• Tailoring: scoping, parameter values, compensating controls
• Overlays and organization-defined controls
• Allocating controls as system, common or hybrid
• Writing the control selection into the security plan
• Getting the plan reviewed and approved

You build A tailored control baseline with a written rationale for every change.

A control that is not documented did not happen, as far as an assessor is concerned. You work with engineers to put controls in place, write implementation statements that say who, what and how, and keep configuration records that support them.

• Turning a control into a technical or procedural change
• Writing implementation statements that can be tested
• Configuration baselines and configuration management
• Inherited controls and the provider’s evidence
• Working with system administrators and developers
• Keeping the system security plan current

You build Implementation statements and supporting evidence for ten controls on one system.

Assessment is a plan, a method and a body of evidence. You write an assessment plan using the examine, interview and test methods, choose the depth that fits the system, and collect evidence that independent reviewers can reproduce.

• Assessment objectives and procedures from SP 800-53A
• Examine, interview and test methods
• Independence of the assessor and why it matters
• Sampling and the depth of assessment
• Collecting and storing evidence
• Rules of engagement for technical testing

You build An assessment plan covering the controls of one system, with methods and evidence for each.

Findings are only useful if the decision maker understands them. You write them clearly, rate their risk, produce the assessment report and track remediation in a plan of action and milestones that has owners and dates.

• Writing a finding: condition, cause, effect, recommendation
• Rating findings by risk to the mission
• The security and privacy assessment reports
• Plan of action and milestones: structure and ownership
• Remediation, retest and closing findings
• Briefing technical and non-technical audiences

You build An assessment report with ten findings and a plan of action and milestones.

Someone must accept the risk in writing. You assemble the authorization package, give the authorizing official a clear risk determination, and learn the possible outcomes, from full authorization to conditions to denial.

• What goes into an authorization package
• Risk determination from findings and the plan
• Authorization to operate, conditions and denial
• Time-limited and ongoing authorization
• Reciprocity and reuse of another’s authorization
• Recording and communicating the decision

You build An authorization package and a one-page decision brief for the authorizing official.

Authorization is a snapshot, and systems keep changing. You build a monitoring strategy, judge the security impact of change, decide when reassessment or reauthorization is needed, and retire a system without leaving data behind.

• Continuous monitoring strategy from SP 800-137
• Monitoring frequency and the metrics that matter
• Security impact analysis for a proposed change
• Ongoing assessment of selected controls
• Triggers for reauthorization
• Decommissioning and disposal as a compliance task

You build A continuous monitoring plan with metrics, frequencies and reauthorization triggers.

Carry one system through every step: prepare, categorize, select, implement, assess, authorize and monitor. You make the judgment calls at each handoff and defend them as you would to an authorizing official.

• Defining the case and its boundary
• Categorizing and selecting controls
• Documenting implementation
• Assessing and writing up findings
• Preparing the authorization decision
• Setting up monitoring after approval

You build A complete authorization package for a sample system, from boundary to monitoring plan.