The process is documented using the Risk Management Worksheet.  Each step will provide general instructions as a guide through completion of the worksheet.  Since the worksheet is generic to all systems, add attachments and / or references as necessary.  Each system will have its own worksheet.  In several of the steps, the advantages of more strenuous documentation than that required by the Worksheet are suggested.

Security controls, both technical and non-technical, should be allocated to system components as the design matures.  Control allocations should be economically layered so that there is no single point of failure in the security protection.  An ideal layering technique is the integration of technical and non-technical controls so that a potential weakness (vulnerability) in one type of control is offset by the strength in another.

It is necessary to maintain a global perspective on security controls throughout the risk management process.  The following figure illustrates how different security controls implemented on various system components combine to form an economic and effective security barrier.  Note the “system” context where a smaller “system” can, and often is, a part of a larger “system.”

Security controls are allocated during design to various architectural components of the system.  Some controls are allocated to the platform (technical controls) and some to the environment (non-technical controls).  Controls vary in the services they provide and some services are visible to the users while others are not.  The following table provides examples of technical and non-technical security controls, where they might be applied within a system’s architecture, and the types of services they provide.

www.bestitdocuments.com