MULTITIERED RISK

MANAGEMENT
A three-tiered approach
Tier 1 - Organization
Tier 1 implements the first component of risk management
(i.e., risk framing), providing the context for all risk
management activities carried out by organizations

 Addresses risk from an organizational perspective by

establishing and implementing governance structures that
are consistent with the strategic goals and objectives of
organizations and the requirements defined by federal laws,
directives, policies, regulations, standards, and
missions/business functions.
Tier 1
• Governance structures provide oversight for the risk
management activities conducted by organizations and
include:
• the establishment and implementation of a risk executive
(function);
• the establishment of the organization’s risk management strategy
including the determination of risk tolerance; and
• the development and execution of organization-wide investment
strategies for information resources and information security.
 TIER TWO—MISSION/BUSINESS PROCESS VIEW

Tier 2 addresses risk from a mission/business process

perspective by designing, developing, and implementing
mission/business processes that support the
missions/business functions defined at Tier 1

• Risk-Aware Mission/Business Processes

• Enterprise Architecture
• Information Security Architecture
TIER THREE—INFORMATION SYSTEMS
VIEW
 The risk management activities at Tier 3 reflect the
organization’s risk management strategy and any risk
related to the cost, schedule, and performance
requirements for individual information systems
supporting the mission/business functions of
organizations.
TRUST AND TRUSTWORTHINESS
 Trust is an important concept related to risk
management

 Trustworthiness is an attribute of a person or

organization that provides confidence to others of the
qualifications, capabilities, and reliability of that entity
to perform specific tasks and fulfill assigned
responsibilitie
ORGANIZATIONAL CULTURE
 Organizational culture refers to the values, beliefs, and
norms that influence the behaviors and actions of the
senior leaders/executives and individual members of
organizations
Thanks