Talk:Industry:Project Review/NIST SP 800-37r1 FPD Appendix D

2009-12-20T12:02:03Z

Patrick Smiley: /* D.11 INFORMATION SECURITY ARCHITECT */

{| align="right"
| __TOC__
|}

<big>APPENDIX D</big>

<big>'''ROLES AND RESPONSIBILITIES'''</big>

KEY PARTICIPANTS IN THE RISK MANAGEMENT PROCESS

== D.1 HEAD OF AGENCY (CHIEF EXECUTIVE OFFICER) ==

== D.2 RISK EXECUTIVE (FUNCTION) ==
It seems that so far, no one role is specifically required or has the objective to define one or more organizational methods for risk calculation. From personal experience, it is too easy to ignore one risk set in deference for another because of professional unfamiliarity with the first. An objective risk calculation toolset defined by organizational management provides a framework for first identifying risk, then prioritizing the addressing of risks.

== D.3 CHIEF INFORMATION OFFICER ==

== D.4 INFORMATION OWNER/STEWARD ==

== D.5 SENIOR INFORMATION SECURITY OFFICER ==

== D.6 AUTHORIZING OFFICIAL ==

== D.7 AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE ==

== D.8 COMMON CONTROL PROVIDER ==

== D.9 INFORMATION SYSTEM OWNER ==

== D.10 INFORMATION SYSTEM SECURITY MANAGER/OFFICER ==

== D.11 INFORMATION SECURITY ARCHITECT ==
Placing the Information Security Architect at the level of system-specific personnel, but ascribing to the position "requirements to protect the organization's core mission and business processes" is a grave mistake. This is confusing in that the System Owner and ISSO duties are specific to the level of the system with an eye toward the overall organization/agency/nation. This description needs to be re-addressed to better discuss the role at the system level.

== D.12 INFORMATION SYSTEM SECURITY ENGINEER ==

== D.13 SECURITY CONTROL ASSESSOR ==

==Footnotes==

[[Category:GIC-NISTSP80037r1FPD]]

Talk:Industry:Project Review/NIST SP 800-37r1 FPD Appendix D

2009-12-20T11:42:42Z

Patrick Smiley: /* D.2 RISK EXECUTIVE (FUNCTION) */

{| align="right"
| __TOC__
|}

<big>APPENDIX D</big>

<big>'''ROLES AND RESPONSIBILITIES'''</big>

KEY PARTICIPANTS IN THE RISK MANAGEMENT PROCESS

== D.1 HEAD OF AGENCY (CHIEF EXECUTIVE OFFICER) ==

== D.2 RISK EXECUTIVE (FUNCTION) ==
It seems that so far, no one role is specifically required or has the objective to define one or more organizational methods for risk calculation. From personal experience, it is too easy to ignore one risk set in deference for another because of professional unfamiliarity with the first. An objective risk calculation toolset defined by organizational management provides a framework for first identifying risk, then prioritizing the addressing of risks.

== D.3 CHIEF INFORMATION OFFICER ==

== D.4 INFORMATION OWNER/STEWARD ==

== D.5 SENIOR INFORMATION SECURITY OFFICER ==

== D.6 AUTHORIZING OFFICIAL ==

== D.7 AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE ==

== D.8 COMMON CONTROL PROVIDER ==

== D.9 INFORMATION SYSTEM OWNER ==

== D.10 INFORMATION SYSTEM SECURITY MANAGER/OFFICER ==

== D.11 INFORMATION SECURITY ARCHITECT ==

== D.12 INFORMATION SYSTEM SECURITY ENGINEER ==

== D.13 SECURITY CONTROL ASSESSOR ==

==Footnotes==

[[Category:GIC-NISTSP80037r1FPD]]

OWASP - User contributions [en]

Talk:Industry:Project Review/NIST SP 800-37r1 FPD Appendix D

Talk:Industry:Project Review/NIST SP 800-37r1 FPD Appendix D