ADMINISTRATIVECOMMUNICATIONSSYSTEMU.S.DEPARTMENTOFEDUCATIONHandbookOCIO-07Page1of72(01/13/2004)Distribution:Approvedby:/s/AllDepartmentofEducationEmployeesWilliamJ.LeidingerAssistantSecretaryforManagementHandbookforInformationTechnologySecurityRiskAssessmentProceduresSupersedesHandbookOCIO-07“HandbookforInformationTechnologySecurityRiskAssessmentProcedures”dated05/12/2003.Fortechnicalquestionsrelatingtothishandbook,pleasecontactJenniferBealeon202-401-2195orviae-mail.DEPARTMENTOFEDUCATIONINFORMATIONTECHNOLOGYSECURITYInformationTechnologySecurityRiskAssessmentProceduresDecember2003HandbookforInformationTechnologySecurityRiskAssessmentProcedures01/13/2004iiTABLEOFCONTENTS1.INTRODUCTION............................................................................................................11.1Purpose...............................................................................................................................11.2Background........................................................................................................................11.3Scope..................................................................................................................................11.4Structure.............................................................................................................................22.RISKASSESSMENTCONCEPTS................................................................................32.1WhyConductaRiskAssessment?....................................................................................32.2WhenShouldaRiskAssessmentbeConducted?..............................................................32.3HowistheRequiredLevelofEffortforaRiskAssessmentDetermined?.......................42.3.1WhatiftheGSSorApplicationisCategorizedasaTier0?.......................................42.4HowdoestheRiskAssessmentFeedintotheC&AProcess?...........................................52.5WhoisResponsibleforConductingtheRiskAssessment?..............................................62.6WhatisInformationSensitivityandMissionCriticality?.................................................72.6.1InformationSensitivity.................................................................................................82.6.2MissionCriticality.......................................................................................................92.7HowareThreatandVulnerabilityDefined?......................................................................92.7.1Threat...........................................................................................................................92.7.2Vulnerability..............................................................................................................112.7.3RelationshipBetweenThreatandVulnerability........................................................112.8WhichSecurityDomainsShouldbeAssessed?..............................................................112.9WhatInformationGatheringTechniquesShouldbeUsedWhenConductingaRiskAssessment?.....................................................................................................................122.9.1Questionnaire.............................................................................................................122.9.2Interviews.............
优质VIP
