PRIVACY IMPACT ASSESSMENT
REVIEWED SUMMARY
Threat Event
An event or situation with potential undesirable
consequences
Technical Access Control
Type where user ID and password system belong
Organization Level Strategy
Tier 1 strategy involving risk assessment, mitigation, and
monitoring
Adversary
Individual or entity conducting detrimental activities
NVD
U.S. gov repository for vulnerability data and NIST
standards
Leveraged Authorization
Authorization involving multiple agencies with minimal
boundaries
Correcting Control Weaknesses
Action: remediated controls are reassessed
Risk Response - Transference
Hiring external writer to mitigate project completion risk
Goals of Risk Management
Economic balance, threat identification, impact
assessment
High Impact Level
, Severe/catastrophic effect on operations/assets due to
CIA loss
Authorization Decisions
RMF decisions excluding common control authorization
System Sensitivity
Based on data processed, stored, and transmitted
Annualized Rate of Occurrence
Frequency estimation of threat occurrence in risk
management
Risk Appetite Guidance
Found in NIST SP 800-39 for organizational risk appetite
FISMA Security Objectives
Confidentiality, Integrity, and Availability
Plan of Action and Milestones
Identifies resources, tasks, milestones for plan
implementation
Single-factor Authentication
Proving identity with email, password, and security
question
Resilience
Ability to adapt and recover from environmental changes
through risk management
Disaster Recovery Plan
Written plan for system recovery in major failure scenarios
Potential Impact
Expected impact level due to loss of CIA on
operations/assets
Corrective Controls
Techniques post-security breach to limit damage extent
Authorization (to operate)
REVIEWED SUMMARY
Threat Event
An event or situation with potential undesirable
consequences
Technical Access Control
Type where user ID and password system belong
Organization Level Strategy
Tier 1 strategy involving risk assessment, mitigation, and
monitoring
Adversary
Individual or entity conducting detrimental activities
NVD
U.S. gov repository for vulnerability data and NIST
standards
Leveraged Authorization
Authorization involving multiple agencies with minimal
boundaries
Correcting Control Weaknesses
Action: remediated controls are reassessed
Risk Response - Transference
Hiring external writer to mitigate project completion risk
Goals of Risk Management
Economic balance, threat identification, impact
assessment
High Impact Level
, Severe/catastrophic effect on operations/assets due to
CIA loss
Authorization Decisions
RMF decisions excluding common control authorization
System Sensitivity
Based on data processed, stored, and transmitted
Annualized Rate of Occurrence
Frequency estimation of threat occurrence in risk
management
Risk Appetite Guidance
Found in NIST SP 800-39 for organizational risk appetite
FISMA Security Objectives
Confidentiality, Integrity, and Availability
Plan of Action and Milestones
Identifies resources, tasks, milestones for plan
implementation
Single-factor Authentication
Proving identity with email, password, and security
question
Resilience
Ability to adapt and recover from environmental changes
through risk management
Disaster Recovery Plan
Written plan for system recovery in major failure scenarios
Potential Impact
Expected impact level due to loss of CIA on
operations/assets
Corrective Controls
Techniques post-security breach to limit damage extent
Authorization (to operate)
