Information Systems Security Manager (ISSM) - Marine Corps ...

NAVSO P-5239-04SEPTEMBER 19953.2 Risk Management ProgramThe DON Risk Management Program includes the process of identifying, measuring,and minimizing events affecting IS resources. The program includes the security activitiesthat span the life cycle of an IS. Risk Management determines the value of the data, whichprotections already exist, and how much more protection (if any) the system needs. Itincludes risk analysis, countermeasure selections, security test and evaluation, and systemreview. The results of these activities provide the information on which a DAA can base anaccreditation decision. Risk management activities do not end with an accreditation decision.Ongoing analysis throughout the life cycle ensures that the security requirements are alwaysmet. The ISSM implements the DON-mandated Risk Management Program for the systemsunder the ISSM’s purview.ResponsibilityThe ISSM ensures that the DON Risk Management Programrequirements are met by ensuring these tasks are accomplished:· Identify specific threats and vulnerabilities to the IS· Identify and apply countermeasures to mitigate theidentified risk· Test the effectiveness of the implemented securitycontrols· Review the continued effectiveness of the implementedsecurity measures.ImplementationRisk AssessmentThe first two tasks are accomplished by conducting a RiskAssessment. The Risk Assessment evaluates the threats andvulnerabilities related to the assets of the activity. The RiskAssessment Guidebook, Module 16 of the NAVSO P series,provides the procedures to be followed for performing a riskassessment based on common, definable systems or networkconfigurations. It identifies and separates systems and networksby operating characteristics, and provides methodologies thatcan be used for each situation.The ISSM is responsible for determining the risk assessmentmethodology to be used for each system under the ISSM’spurview. The ISSM is responsible for ensuring that a riskassessment is performed on each IS under the ISSM’s purview.14