Security Risk Management and Operations
Domain 3 addresses security risk management and operations, including how risk is assessed, treated, authorized, and monitored after deployment. The exam tests risk framing, likelihood and impact analysis, risk response selection, authorization packages, POA&M management, continuous monitoring, and operational vulnerability and incident processes.
Core rules
- Frame risk against mission and business objectives; document assumptions, sources, and risk tolerance.
- Identify assets, threats, vulnerabilities, existing controls, and potential adverse impacts, including mission dependencies.
- Analyze likelihood and impact with context; a severity score alone does not determine enterprise risk.
- Select responses: mitigate, transfer, avoid, or accept; record rationale and residual risk with an accountable owner.
- Authorize operation with explicit conditions, then monitor controls, indicators, and change triggers.
- Feed incidents, scans, and audit findings back into risk assessment and the POA&M.
Worked example
A scan finds a critical vulnerability on a legacy application supporting a maintenance workflow. CVSS is high, but the system is segmented, the vulnerable service is disabled, and a compensating control logs attempted access. The team still opens a POA&M because the supplier is end-of-life. It sets a 60-day decision point, tests a replacement, and accepts residual risk for 30 days with the mission owner's signature. Monitoring verifies the compensating control weekly.
Traps
Treating risk assessment as a one-time document; using CVSS as the only decision input; accepting risk without authority; missing aggregations and dependencies; and letting POA&M items close without evidence.