ACP 122 (F) - Multilateral Planners Conference

UNCLASSIFIED
ACP 122(F)
CHAPTER 3
RISK MANAGEMENT
OVERVIEW
301. Combined forces increasingly rely on interconnected CIS for command and control, and
administration purposes. 1
302. The management of the risk to a CIS is effected through a system security architecture
comprising operational, procedural, physical, personnel and technical components, selected in
the light of an assessment of the risks to the system, the definition of system security
requirements and the analysis of optional security architecture solutions. The design of the
security architecture is an integral part of the system design. The development of the security
architecture and its maintenance throughout the life of the system is accomplished through the
security risk management process.
POLICY
303. In order to ensure that adequate, cost-effective security is provided to CIS, there is a
requirement for the orderly examination of sensitivities, threats, and vulnerabilities in order to
determine the risk to any given CIS and what protective measures/safeguards are required. This
process is known as risk assessment, and is the fundamental basis of risk management. The
security risk management process is applicable to all new and in-service CIS within combined
operations. New systems shall start applying the risk management process at the beginning of the
planning stage. Risk management for in-service systems forms part of the configuration
management process.
RISK MANAGEMENT PROCESS
304. The security risk management process is the process by which resources are planned,
organized, directed and controlled to ensure the risk to national or combined CIS and the
information they handle remains within acceptable bounds at optimal cost. The process enables
the definition, implementation and life cycle management of the system security architecture. It
is equally valid for small stand-alone systems as for large networked systems - the difference in
application lies in the degree of system complexity and the extent of the security requirement.
The security risk management process applies regardless of where system planning,
implementation and operation are accomplished.
1 Not all of the information processed, stored or transmitted by these systems would be classified in the national
interest. Some of it may be personal (evaluations, medical reports) or financial (project cost projections, budgets)
information that is sensitive and therefore warrants some form of protection against unauthorised disclosure,
removal, destruction, interruption or modification.
3-1 Original
UNCLASSIFIED