A-6. Interoperability

There are many approaches to managing risk and subsequently many different RMFs. In fact, ENISA¹²⁸ enumerated no less than 29 such RMFs with potential interoperability— including the HITRUST RMF —in support of an initiative to develop an interoperable EU RMF.¹²⁹ Selection was based on the following criteria:

• “Risk management frameworks and methodologies used as best practice in the industry [emphasis added], regardless of their scope, type and size of organisation, target audience, etc.;
• “Risk management frameworks and methodologies proposed as standards and guidelines by international and national standardisation bodies;
• “Risk management methodologies and methods proposed by academia.”¹³⁰

Criteria for exclusion of an RMF was explained as follows.

We excluded risk management frameworks and methodologies that were obsolete (i.e., those that had not been supported for more than ten years) and that did not support the fundamental risk management processes (i.e., those that provide guidance only for risk treatment, etc.). Further, we excluded risk management frameworks and methodologies that were proposed in academic sources but did not provide specific guidance for their implementation. Thus, the survey aimed to identify the state-of-the-art risk management frameworks and methodologies [emphasis added], rather than to provide an exhaustive list of all risk management frameworks and methodologies.¹³¹

In addition to those provided by ISO, NIST, and HITRUST, notable RMFs included in the list of “prominent risk management frameworks and methodologies that are currently in use”¹³² include but aren’t limited to those provided by Germany’s BSI,¹³³ Carnegie Mellon University¹³⁴ in the U.S., the European Telecommunications Standards Institute (ETSI),¹³⁵ Luxembourg’s Cyberworld Awareness and Security Enhancement Services (CASES),¹³⁶ the French Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI),¹³⁷ the Spanish El Ministerio de Asuntos Económicos y Transformación Digital,¹³⁸ the European Commission Directorate-General for Communication Security,¹³⁹ and The Open Group,¹⁴⁰ among others.

ENISA’s analysis of these frameworks resulted in the identification of eight features “that enable (or limit) the potential for interoperability of [RMFs] and methodologies.”¹⁴¹

• Support for other risk management standards, frameworks, and methodologies
• Breadth of the risk management components addressed
• Whether the approach addresses assets, scenarios, or both
• Use of quantitative, semi- or quasi-quantitative, or quantitative methods of evaluating risk
• Types of catalogs or libraries used to support the approach
• Method of risk calculation
• Languages supported by the method (with an English version being of advantage)
• Cost of licensing

ENISA’s final report on interoperability¹⁴² includes an evaluation of 16 of the 29 standards, frameworks, and methods based on a more detailed assessment and scoring model.¹⁴³ As the HITRUST RMF was not included, we provide an evaluation of the HITRUST RMF consistent with the 16 ENISA provided—first without the implementation of QQRRA and then with its implementation—in the table below.

Table 5. Potential Interoperability of the HITRUST RMF

The following table provides a summary of the potential interoperability of these 16 standards, frameworks, and methods¹⁴⁴ along with the HITRUST RMF along with scores for the HITRUST RMF.

Table 6. Potential Interoperability of Various Prominent Risk Management Standards, Frameworks, & Methodologies

Current interoperability scores are consistent with the many and varied ways in which HITRUST has seen public and private sector organizations use the HITRUST RMF, which can run the gamut from simply using the HITRUST CSF as a compendium of best practices to adopting and integrating the HITRUST CSF, HITRUST Assurance Program, and supporting components into their organization-wide information protection and risk management programs. Integration of QQRRA into the HITRUST Approach vis-à-vis relevant products, services, and tools will further enhance this level of interoperability and provide improved support for integration into organizational information protection and risk management programs, regardless of any other standards, frameworks, or methodologies these organizations may also leverage.

¹²⁸ ENISA (2022). About ENISA – The European Union Agency for Cybersecurity.

¹²⁹ ENISA (2022a, Jan). Compendium of Risk Management Frameworks with Potential Interoperability: Supplement to the Interoperable EU Risk Management Framework Report. Attiki, GR: Author.

¹³⁰ Ibid., pp. 6-7.

¹³¹ Ibid, p. 7.

¹³² Ibid., p. 8.

¹³³ BSI (2022). BSI-Standards.

¹³⁴ Carnegie Mellon University Software Engineering Institute (2022). SEI: Publications: Digital Library: Search Results: OCTAVE.

¹³⁵ European Telecommunications Standards Institute, ETSI (2022). Standards: Search: Cybersecurity.

¹³⁶ MONARC (2022). What is MONARC?

¹³⁷ Agence Nationale de la Securite des Systems d’Information, ANSSI (2022). EBIOS Risk Manager – The Method.

¹³⁸ Portal Administración Electrónica (2022). The Portal E-government: Cover Page of Documentation: Cover of Methodologies and Guidelines: Metodología de Análisis y Gestión de Riesgos de los Sistemas de Información.

¹³⁹ European Commission (2022). Home: Departments and Executive Agencies: Informatics.

¹⁴⁰ The Open Group (2022). Risk Analysis.

¹⁴¹ ENISA (2022a), p. 31.

¹⁴² ENISA (2022b, Jan). Interoperable EU Risk Management Framework: Methodology for and assessment of interoperability among risk management frameworks and methodologies. Attiki, GR: Author.

¹⁴³ Ibid., pp. 6-12.

¹⁴⁴ Ibid., pp. 24-25

¹⁴⁵ JTF (2018, Dec).

¹⁴⁶ Caralli, R., Stevens, J., Young, L., and Wilson, W. (2007, May). Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process (CMU/SEI-2007-TR-012). Pittsburgh: Carnegie Mellon University.

¹⁴⁷ Alberts, C., Dorofee, A., Stevens, J., and Woody, C. (2005, Jan). OCTAVE®-S Implementation Guide, Version 1.0 (CMU/SEI-2003-HB-003). Pittsburgh: Carnegie Mellon University.

¹⁴⁸ ISO/IEC (2018). Information Technology – Security Techniques – Information Security Risk Management (ISO/IEC 27005:2018). Geneva: Author.

¹⁴⁹ CASES (2016, Apr). MONARC Version 1.0. Luxembourg: Author.

¹⁵⁰ Tucker, B. (2020, Nov). Advancing Risk Management Capability Using the OCTAVE FORTE Process (CMU/SEI-2020-TN-002). Pittsburgh: Carnegie Mellon University.

¹⁵¹ The Open Group (2021, Nov). Risk Analysis (O-RA), Version 2.0.1. Berkshire, UK: Author.

¹⁵² BSI (2017, Oct). IT-Grundschutz Methodology (BSI-Standard 200-2). Bonn: Author.

¹⁵³ Baltic and International Maritime Council, BIMCO (2020). The Guidelines on Cybersecurity Onboard Ship, Version 4.0.

¹⁵⁴ JTF TI (2011, Mar).

¹⁵⁵ ANNSI (2022).

¹⁵⁶ ETSI (2017, Oct). CYBER; Methods and protocols; Part 1: Method and pro forma for Threat, Vulnerability, Risk Analysis (TVRA) (ETSI TS 102 165-1 V5.2.3). Sophia Antipolis Cedex, FR: Author.

¹⁵⁷ Portal Administración Electrónica (2022).

¹⁵⁸ European Commission (2020, 8 Nov). IT Security Risk Management Methodology v1.2: Description of the Methodology (v1.2 r19).

¹⁵⁹ JTF TI (2012, Sep).

¹⁶⁰ Club de la Sécurité de l’Information Français, CLUSIF (2022). Reception: Services: Risk Management: The Fundamentals of MÉHARI (Google Translation).