Definitions
Threat
Any circumstance or event with the potential to adversely impact organizational operations, assets, or individuals by exploiting vulnerabilities in an information system.
Vulnerability
A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exploited by a threat source to cause harm.
Risk
The measure of potential adverse impact to an organization's operations, assets, or individuals resulting from a threat successfully exploiting a vulnerability in an information system.
Directive (RA-1 Risk Assessment)
GNB shall establish, implement, and maintain a formal Risk Assessment directive to ensure that cyber security risks to organizational information, systems, and operations are systematically identified, analyzed, documented, and addressed.
Purpose
This directive provides the foundational governance required to ensure the organization understands and manages security risks in a consistent, transparent, and repeatable manner.
The objective of the Risk Assessment directive is to ensure that a standardized approach is used for cyber security risk management on GNB information systems and assets. This includes Business Impact Assessments (BIA), asset classification and prioritization, risk assessment and treatment, vulnerability monitoring and scanning, supply chain risk assessments.
