BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

9.2 Risk Assessment

NIST PIV and digital identity SP 800-116 Rev. 1 against SP 800-116
All changes in this version
removed 9 Migration Strategy part of 9

Title changed

Before · SP 800-116

Risk Assessment

After · SP 800-116 Rev. 1

Risk Assessment

Control changed

Before · SP 800-116

Vulnerability analyses and risk assessments provide a method of prioritizing the criticality of assets (or the impact of the loss of assets), threats, and countermeasure strategies. A structured process allows for the documentation of risks by subject matter experts based on their judgments and assumptions. The final product is a broad set of priorities, both physical and cyber, that contribute to the protection of the critical systems or functions. The input to this assessment is the understanding of risks in the current environment. Specifically, knowledge of existing vulnerabilities and the impact of attacks should be attained. Section 4 provides attack vectors that must be well-understood and acted upon. The goal should be to embed the countermeasures against the identified threats in migration to PIV-enabled PACS. HSPD-12 requires the standard to provide graduated levels of security in PIV credentials. Note that the combination of one or more authentication mechanisms must be employed to mitigate the counterfeiting, skimming, sniffing, social engineering, and cloning threats.

After · SP 800-116 Rev. 1

Vulnerability analyses and risk assessments provide a method of prioritizing the criticality of assets (or the impact of the loss of assets), threats, and countermeasure strategies. A structured process allows for the documentation of risks by subject matter experts based on their judgments and assumptions. The final product is a broad set of priorities, both physical and cyber, that contribute to the protection of the critical systems or functions. The input to this assessment is the understanding of risks in the current environment. Specifically, knowledge of existing vulnerabilities and the impact of attacks should be attained. Section 4 provides attack vectors that must be well-understood and acted upon. The goal should be to embed the countermeasures against the identified threats in migration to PIV-enabled PACS. HSPD-12 requires the standard to provide graduated levels of security in PIV credentials. Note that the combination of one or more authentication mechanisms must be employed to mitigate the counterfeiting, skimming, sniffing, social engineering, and cloning threats.