FISMA and the Risk Management Framework

Chapter 4

Thinking About Systems

Information in this chapter:

• Defining Systems in Different Contexts

• Perspectives on Information Systems

• Establishing Information System Boundaries

• Maintaining System Inventories

Risk management is an essential function at all levels of an organization. Public and private sector guidance on managing risk agrees on the central tenet that effective risk management must be integrated at an organization-wide level to engage leaders, business owners, and information technology managers and staff in a collaborative approach that promotes understanding of the sources of risk faced by the organization and ways to address that risk. This approach applies to all types of risk, not just to information security risk, ...