South Plains College

Information Services (SPC-IS)

 

Data Security Risk Management Standard: I-B(a)

 

Purpose and Benefits

Risk management is a critical component of any information security program.  It helps ensure that any risk to confidentiality, integrity, and availability is identified, analyzed, and maintained at acceptable levels.  Risk assessments allow management to prioritize and focus on areas that pose the most significant impact on critical and sensitive information assets. This provides the foundation for informed decision-making regarding information security.

Federal and State mandates require routine assessments to identify risk and ensure appropriate controls. Risk assessments allow alignment of information security with business objectives and regulatory requirements.  Identifying information security risks and considering control requirements from the onset is essential and far less costly than retrofitting or addressing the impact of a security incident.

This standard provides a risk management framework for evaluating the security posture, identifying gaps, and determining appropriate actions.

Scope

This standard covers all risks to SPC’s information systems’ confidentiality, integrity, and availability. These must be assessed as internal, external, supply chain, connectivity, security, and other unknown risks.

Information Statement

Information security risk management considers vulnerabilities, threat sources, and security controls planned or in place.  These inputs determine the risk level of information, systems, processes, and individuals supporting business functions.

While risk management and related assessment activities can take many forms (e.g., formal risk assessment, audits, security reviews, configuration analysis, vulnerability scanning, and testing), all aim at the same goal: identifying and acting on risk to improve overall security posture.

It should be noted that an organization can never eliminate risk but can take steps to manage risk.

Per the Information Security Policy, any system or process supporting business functions must be appropriately managed for risk and undergo risk assessments as part of its life cycle.

 

Risk Management Process

The risk management process is iterative and should be followed throughout a system’s or process’s life cycle.

1.    Frame The Risk

The first step in managing risk is to:

1. develop a strategy for conducting your risk assessment that considers assumptions, constraints, priorities, dependencies, tradeoffs, and resources that will be used; and
2. Determine the risk tolerance or acceptable level of risk. For information security risk decisions that may affect multiple entities, the lowest level of risk tolerance for those entities must prevail. Entities must recognize how fundamental this decision is to the risk management process. Risk tolerance is an executive-level decision, and SPC information technology (IT) will not determine the risk tolerance for SPC systems.

2.    Assess The Risk

Assessing risk starts with identifying and classifying assets within scope. Risk is evaluated by determining the threats and vulnerabilities to these assets, recognizing the potential impact of each vulnerability being exploited, and determining the likelihood of occurrence. Types of information security risk assessments include, but are not limited to:

1. Enterprise Risk Assessments – Assesses risks to core agency assets, operational processes, and functions;
2. Physical Infrastructure Assets and Systems Risk Assessments – Identifies and assesses vulnerabilities and risks to core physical infrastructure assets and systems;
3. Project Security Risk Assessments (New Risks) – Identifies and assesses new risks to existing components introduced by new technology or service offerings.
4. Change Request Risk Assessments—Assesses the risk of change to ensure that the proposed change does not compromise security.

 

 

 

3.    Respond to Risk

Once risk has been assessed, the entity must determine and implement the appropriate course of action.  Options include:

1. Risk Acceptance—This is a documented decision not to act on a given risk at a given time and place. It is not negligence or “inaction” and can be appropriate if the risk falls within the risk tolerance level.
2. Risk Avoidance – These are specific actions taken to eliminate the activities or technologies that are the basis for the risk. This is appropriate when the identified risk exceeds the risk tolerance, even after controls have been applied (i.e., residual risk). 
3. Risk Mitigation/Reduction – These are specific actions taken to eliminate or reduce risk to an acceptable level. This is the most common and appropriate approach where controls can reduce the identified risk. 
4. Risk Transfer/Sharing—These are specific actions taken to shift responsibility for the risk, in whole or in part, to a third party. This may be appropriate when it is more cost-effective to transfer the risk or when a third party is better suited to manage it.

4.    Monitor The Risk

SPC monitors the effectiveness of its risk response measures by verifying that the controls implemented are implemented correctly and operating as intended. Risk Assessment occurs at least annually.

Compliance

This standard shall take effect upon publication. Compliance is expected with all enterprise policies and standards, which may be amended anytime.

If compliance with this standard is not feasible or technically possible, or if deviation from this policy is necessary to support a business function, entities shall request an exception through the Chief Information Security Officer’s exception process.

Related Documents

1 TAC § 202.74 (a)(2)

 

NIST SP 800-30, Guide for Conducting Risk Assessments

NIST SP 800-39, Managing Information Security Risk

Texas Security Controls Standards Catalog Control Group: AU-1, PM-4, PM-9, PM-10, RA-3, SA-3, SA-4, SC-13, SR-1, SR-2, SR-3

NIST Function Groups: ID.RM-1