Risk Management Strategy

Approval #

Revision History #

Review cycle: Every year, before the annual Federal Information Security Modernization Act (FISMA) report, and after a major change in mission, threat, or law.

Mandate. Federal law and guidance require the Organization to have one strategy for managing cybersecurity and privacy risk:

• National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 control PM-9 requires a risk management strategy, PM-28 requires a risk framing statement, and RA-7 requires a response to each finding.
• NIST SP 800-37 Rev. 2 task P-2 requires a strategy that states the Organization’s risk tolerance. Task P-3 requires an organization-wide risk assessment.
• Office of Management and Budget (OMB) Circular A-130, Appendix I §3(a), requires a risk management process that frames, assesses, responds to, and monitors risk across three tiers.
• FISMA, 44 U.S.C. § 3554, requires protections that match the risk, and periodic assessments of risk.
• OMB Circular A-123, revised on March 10, 2026, requires agency leadership to develop risk appetite and risk tolerance levels.
• NIST Cybersecurity Framework (CSF) 2.0 sets the outcomes for a risk management strategy in its Risk Management Strategy category (GV.RM). The Inspector General (IG) FISMA metrics CG.02 and RAM.05 measure them.

The CISO owns this plan and keeps it current. The agency head approves the strategy and its Risk Appetite and Tolerance Statement. The Cybersecurity Risk Register Template (TMPL-RISKREG-001) gives the fields every risk register uses. The Program Management Policy (POL-PM), the Risk Assessment Policy (POL-RA), and the Risk Assessment Procedures (PROC-RA) apply this strategy and do not repeat it.

1. Purpose and Scope #

The strategy states how the Organization frames, assesses, responds to, and monitors cybersecurity and privacy risk. It applies to every system the Organization owns or uses, including systems that contractors and cloud providers run for it. It applies at all three tiers in NIST SP 800-39: the Organization, its missions and business processes, and its systems. It also covers new technology, including Super Intelligence (SI), the term Executive Order 14434 uses (EO 14434).

Every official who makes a risk decision uses this strategy. That includes decisions to authorize a system, buy a product or service, fund an investment, or accept a finding.

2. Roles and Responsibilities #

3. How the Organization Frames Risk #

NIST SP 800-39 and control PM-28 ask the Organization to state its assumptions, constraints, priorities and trade-offs, and risk tolerance. The risk executive function records them here.

3.1 Assumptions #

• Capable adversaries, including nation-state actors, target the Organization’s systems, data, staff, and suppliers.
• Attackers exploit published vulnerabilities within days, so the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog shows the risks most likely to cause harm.
• Most of the Organization’s systems run on cloud services or depend on contractors, so much of its risk is shared with providers.
• Staff work from Organization sites, telework locations, and travel. Some carry government-furnished equipment abroad.
• Each system’s Federal Information Processing Standards (FIPS) 199 categorization shows the harm a loss would cause. Systems that hold PII or sensitive financial data, and systems reachable from the internet, call for lower tolerance.
• Staff with risk management duties have the training their roles require and know this strategy.

3.2 Constraints #

• Laws, OMB policy, and CISA directives set deadlines and controls the Organization cannot waive.
• Funding, staff, and contract terms limit how fast the Organization can fix weaknesses.
• Legacy systems and vendor schedules limit when some fixes can happen.
• Providers control some parts of the systems the Organization uses.
• The Organization must keep an accurate inventory of hardware, software, cloud services, and data, as the IT Asset Management Policy sets out.

3.3 Priorities and trade-offs #

1. The Organization protects its mission essential functions and High Value Assets (HVAs) first.
2. It protects PII and sensitive financial and transaction data next.
3. It funds organization-wide capabilities that reduce risk for many systems before fixes that reduce risk for one.
4. It meets binding federal directives on time, whatever their effect on other work.

When missions compete for the same resources, the Senior Accountable Official for Risk Management decides the trade-off with the risk executive function. Examples include grouping several risks under one response, or speeding up the replacement of a legacy system instead of fixing it. The ISSO records each trade-off decision in the register.

4. Risk Appetite and Tolerance Statement #

Risk appetite is the amount and type of risk the Organization will accept to carry out its mission. Risk tolerance is the acceptable variation around a measure, which officials can check. OMB Circular A-123 asks agency leadership to develop both. NIST CSF 2.0 asks that they be stated, communicated, and kept current (GV.RM). The agency head approves this statement, and the CISO sends it to every AO, System Owner, and ISSO.

4.1 What each appetite level means #

4.2 Appetite by category #

The proposed levels below are the starting point. The agency head confirms or changes each level when approving the statement.

4.3 Measurable tolerances #

An AO may not accept a risk that would put a measure outside its tolerance unless the Senior Accountable Official for Risk Management first approves it, under the acceptance table in this strategy. The AO still signs the acceptance and the authorization decision. A tolerance of “None” comes from a federal requirement, and nobody may accept a risk outside it.

4.4 Approval of the strategy and the statement #

The agency head signs below to approve this strategy and the Risk Appetite and Tolerance Statement. The Senior Accountable Official for Risk Management signs to recommend them.

Evidence: the signed approval block, the risk executive function’s minutes, and the distribution record in the document management system.

5. How Officials Adopt and Update the Strategy #

The CISO starts the update cycle each year, and after a major change in mission, threat, or law.

The CISO reviews and updates the strategy [PM-09 parameter 1 — to be defined], and at least once each year before the annual FISMA report. The risk executive function reviews the risk framing statement [PM-28 parameter 2 — to be defined].

Evidence: the drafts and comments, the minutes, the signed approval block, and the distribution record.

6. How the Organization Assesses Risk #

6.1 Method #

Staff assess risk with NIST SP 800-30 Rev. 1 at all three tiers. They rate likelihood with the scales in its Appendix G and impact with the scales in its Appendix H. They combine the two with the matrix below, from its Table I-2, to get the level of risk. NIST IR 8286A Rev. 1 calls this level the exposure rating.

Staff use one scale everywhere, so risks from different systems can be compared and combined. A scanner’s severity score is an input to likelihood and impact, not the final level of risk.

6.2 System-level risk assessments #

The System Owner and the ISSO assess each system’s risk with the Risk Assessment and FIPS 199 Categorization Template (TMPL-RA-001), as the Risk Assessment Procedures set out. They record each risk at or above Moderate in the system’s register entries in the GRC system.

6.3 Organization-wide risk assessment #

The CISO runs the organization-wide risk assessment every year, and after a major threat or mission change, as NIST SP 800-37 Rev. 2 task P-3 describes.

Evidence: the input list, the organization-level risk assessment, the register entries, and the minutes.

7. How the Organization Responds to Risk #

7.1 Response types #

The Organization uses four responses to a negative risk, as NIST IR 8286 Rev. 1 and OMB Circular A-123 describe:

• Mitigate: add or strengthen controls until the risk is within tolerance.
• Accept: keep the risk, within tolerance, with monitoring and an end date.
• Transfer or share: move part of the risk to another party, such as a provider under contract. The Organization keeps responsibility for its data and its mission.
• Avoid: stop or change the activity that causes the risk.

For a positive risk, an opportunity, staff may record one of four responses: realize, share, enhance, or accept.

7.2 Who may accept which level of risk #

Each risk acceptance ends on a set date, no later than [Assignment: organization-defined longest term of a risk acceptance, in months — to be defined] and no later than the end of the system’s authorization. Nobody may accept a risk that a law, an OMB policy, or a binding CISA directive forbids. That includes a KEV entry past its due date. The System Owner fixes the weakness, removes the asset from the network, or asks CISA for an extension where the directive allows one.

7.3 Responding to a risk #

Evidence: the proposed responses, the POA&M items, the risk acceptances with their signatures and end dates, and the updated register entries.

8. How the Organization Monitors Risk #

Staff monitor risk to confirm that controls work, that responses reduce risk as planned, and that changes do not raise risk without a decision. The Information Security Continuous Monitoring (ISCM) Strategy (PLAN-ISCM-001) sets the monitoring of each control. The measures in the Risk Appetite and Tolerance Statement are the Organization’s key risk indicators.

Evidence: the register history, the monthly tolerance reports, the notices, the renewal and closure records, and the minutes.

9. How Cybersecurity Risk Feeds Enterprise Risk Management #

OMB Circular A-123 asks agencies to consider information security risk with other risks, and suggests a Risk Management Council and a risk profile. OMB Circular A-11, §260.8, encourages a risk profile as part of the annual strategic review. NIST IR 8286 Rev. 1 and NIST IR 8286C Rev. 1 describe how to combine cybersecurity risk registers into the enterprise risk register. The Cybersecurity Risk Register Template gives the steps for the roll-up.

Evidence: the roll-up reports, the enterprise risk profile, the council minutes, and the decisions sent back to the CISO.

10. Measuring and Reporting #

The CISO reports these results to the CIO each month and to the risk executive function at each meeting:

• Each tolerance measure in the Risk Appetite and Tolerance Statement, with its trend.
• The number of risk acceptances by level, and the number that end within 30 days.
• The number of risks escalated to the risk executive function, and the decisions made.

Each year, the CIO and the CISO answer the FISMA questions on risk management. The Inspector General rates IG FISMA metric CG.02, on the use of a risk management strategy, and RAM.05, on cybersecurity and enterprise risk management. The IG metrics issued for fiscal year 2025 also apply to the fiscal year 2026 evaluations. The CISO keeps this strategy, the register, and the minutes ready as evidence for both metrics. (FY 2025 IG FISMA Reporting Metrics, CG.02 and RAM.05)

Evidence: the monthly reports, the meeting packages, and the annual FISMA submission.

11. Related Documents #

• Cybersecurity Risk Register Template (TMPL-RISKREG-001): the register fields and the roll-up steps.
• Risk Assessment and FIPS 199 Categorization Template (TMPL-RA-001): each system’s risk assessment.
• POA&M Management Procedure (PROC-POAM-001): mitigations that cannot finish at once.
• Information Security Continuous Monitoring (ISCM) Strategy (PLAN-ISCM-001): monitoring of controls.
• Vulnerability Management Policy (POL-VM-001): vulnerability due dates.
• Program Management Policy (POL-PM) and Risk Assessment Policy (POL-RA): the rules that name this strategy.
• Information Security Program Plan (ISPP-001): how this strategy fits the security program.

12. Derived Governance Requirements #

• Keep an enterprise risk profile that includes cybersecurity risk, overseen by a Risk Management Council, as a recommended practice. (OMB Circular A-123, §VII)
• Establish a risk management strategy for the Organization that determines and states its risk tolerance, with the head of agency primarily responsible. (NIST SP 800-37 Rev. 2, Task P-2)
• Complete an organization-wide risk assessment, or update the existing one. (NIST SP 800-37 Rev. 2, Task P-3)
• Frame risk by stating the risk assumptions, constraints, risk tolerance, and priorities and trade-offs that shape how the Organization assesses, responds to, and monitors risk. (NIST SP 800-39, §2.1)
• Run an agency-wide risk management process that frames, assesses, responds to, and monitors information security and privacy risk at the organization, mission or business process, and system levels. (OMB Circular A-130, Appendix I §3(a))
• Provide information security protections that match the risk and the size of the harm that unauthorized access, use, disclosure, disruption, change, or destruction could cause. (44 U.S.C. § 3554(a)(1)(A))
• Establish, communicate, and maintain risk appetite and risk tolerance statements. (NIST CSF 2.0, GV.RM)
• Include cybersecurity risk management activities and outcomes in enterprise risk management processes. (NIST CSF 2.0, GV.RM)
• Have the Organization’s most senior leadership set its risk appetite, as the guide for setting strategy and choosing objectives. (OMB Circular A-11, §230.7)
• Use the annual strategic review to analyze enterprise risk, which may include developing a risk profile. (OMB Circular A-11, §260.8)

13. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Authorization Act (44 U.S.C. §§ 3607-3616 (FY2023 NDAA, Pub. L. 117-263, § 5921)), December 23, 2022.
• FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
• FIPS 199: Standards for Security Categorization, February 2004.
• FY 2025 IG FISMA Metrics and Evaluation Guide, January 1, 2025.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST IR 8286 Rev. 1: Integrating Cybersecurity and Enterprise Risk Management (ERM), December 18, 2025.
• NIST IR 8286A Rev. 1: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, December 18, 2025.
• NIST IR 8286C Rev. 1: Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight, December 18, 2025.
• NIST IR 8286D: Using Business Impact Analysis to Inform Risk Prioritization and Response, February 26, 2025.
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, September 2012.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• OMB Circular A-11: Preparation, Submission, and Execution of the Budget, August 29, 2025.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025.
• Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.
• Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.