What are the steps to perform a basic cyber risk assessment for a new mission system?

What are the steps to perform a basic cyber risk assessment for a new mission system?

• A. Identify assets and threats, assess vulnerabilities and likelihood, estimate impact, calculate risk, select mitigations, implement them, and monitor.
• B. Randomly choose mitigations without assessment.
• C. Only catalog assets without considering threats.
• D. Ignore risk and proceed with operation.

Answer: (A)

A basic cyber risk assessment for a new mission system follows a disciplined sequence that connects protection actions directly to mission impact. Start by identifying what needs protection—assets, data, and functions critical to the mission—and the threats that could compromise them. Then evaluate vulnerabilities in the system and estimate how likely those threats are to exploit them. Next, assess the potential consequences if an exploit occurs, considering mission impact, safety, and operational readiness. With likelihood and impact in hand, calculate overall risk and prioritize mitigations that will most effectively reduce that risk. After selecting and implementing those mitigations, set up ongoing monitoring to verify they work and to detect changes in the threat or system that might alter risk. This approach ensures security efforts are targeted, justified by potential harm to the mission, and kept current over time.

A basic cyber risk assessment for a new mission system follows a disciplined sequence that connects protection actions directly to mission impact. Start by identifying what needs protection—assets, data, and functions critical to the mission—and the threats that could compromise them. Then evaluate vulnerabilities in the system and estimate how likely those threats are to exploit them. Next, assess the potential consequences if an exploit occurs, considering mission impact, safety, and operational readiness. With likelihood and impact in hand, calculate overall risk and prioritize mitigations that will most effectively reduce that risk. After selecting and implementing those mitigations, set up ongoing monitoring to verify they work and to detect changes in the threat or system that might alter risk. This approach ensures security efforts are targeted, justified by potential harm to the mission, and kept current over time.