A-5. Interoperability

There are many approaches to managing risk and subsequently many different RMFs. In fact, ENISA¹²⁶ enumerated no less than 29 such RMFs with potential interoperability— including the HITRUST RMF —in support of an initiative to develop an interoperable EU RMF.¹²⁷ Selection was based on the following criteria:

• “Risk management frameworks and methodologies used as best practice in the industry [emphasis added], regardless of their scope, type and size of organisation, target audience, etc.;
• “Risk management frameworks and methodologies proposed as standards and guidelines by international and national standardisation bodies;
• “Risk management methodologies and methods proposed by academia.”¹²⁸

Criteria for exclusion of an RMF was explained as follows.

We excluded risk management frameworks and methodologies that were obsolete (i.e., those that had not been supported for more than ten years) and that did not support the fundamental risk management processes (i.e., those that provide guidance only for risk treatment, etc.). Further, we excluded risk management frameworks and methodologies that were proposed in academic sources but did not provide specific guidance for their implementation. Thus, the survey aimed to identify the state-of-the-art risk management frameworks and methodologies [emphasis added], rather than to provide an exhaustive list of all risk management frameworks and methodologies.¹²⁹

In addition to those provided by ISO, NIST, and HITRUST, notable RMFs included in the list of “prominent risk management frameworks and methodologies that are currently in use”¹³⁰ include but aren’t limited to those provided by Germany’s BSI,¹³¹ Carnegie Mellon University¹³² in the U.S., the European Telecommunications Standards Institute (ETSI),¹³³ Luxembourg’s Cyberworld Awareness and Security Enhancement Services (CASES),¹³⁴ the French Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI),¹³⁵ the Spanish El Ministerio de Asuntos Económicos y Transformación Digital,¹³⁶ the European Commission Directorate-General for Communication Security,¹³⁷ and The Open Group,¹³⁸ among others.

ENISA’s analysis of these frameworks resulted in the identification of eight features “that enable (or limit) the potential for interoperability of [RMFs] and methodologies.”¹³⁹

• Support for other risk management standards, frameworks, and methodologies
• Breadth of the risk management components addressed
• Whether the approach addresses assets, scenarios, or both
• Use of quantitative, semi- or quasi-quantitative, or quantitative methods of evaluating risk
• Types of catalogs or libraries used to support the approach
• Method of risk calculation
• Languages supported by the method (with an English version being of advantage)
• Cost of licensing

ENISA’s final report on interoperability¹⁴⁰ includes an evaluation of 16 of the 29 standards, frameworks, and methods based on a more detailed assessment and scoring model.¹⁴¹ As the HITRUST RMF was not included, we provide an evaluation of the HITRUST RMF consistent with the 16 ENISA provided—first without the implementation of QQRRA and then with its implementation—in the table below.

Table 5. Potential Interoperability of the HITRUST RMF

The following table provides a summary of the potential interoperability of these 16 standards, frameworks, and methods¹⁴² along with the HITRUST RMF along with scores for the HITRUST RMF.

Table 6. Potential Interoperability of Various Prominent Risk Management Standards, Frameworks, & Methodologies

Current interoperability scores are consistent with the many and varied ways in which HITRUST has seen public and private sector organizations use the HITRUST RMF, which can run the gamut from simply using the HITRUST CSF as a compendium of best practices to adopting and integrating the HITRUST CSF, HITRUST Assurance Program, and supporting components into their organization-wide information protection and risk management programs. Integration of QQRRA into the HITRUST Approach vis-à-vis relevant products, services, and tools will further enhance this level of interoperability and provide improved support for integration into organizational information protection and risk management programs, regardless of any other standards, frameworks, or methodologies these organizations may also leverage.

¹²⁶ ENISA (2022). About ENISA – The European Union Agency for Cybersecurity.

¹²⁷ ENISA (2022a, Jan). Compendium of Risk Management Frameworks with Potential Interoperability: Supplement to the Interoperable EU Risk Management Framework Report. Attiki, GR: Author.

¹²⁸ Ibid., pp. 6-7.

¹²⁹ Ibid, p. 7.

¹³⁰ Ibid., p. 8.

¹³¹ BSI (2022). BSI-Standards.

¹³² Carnegie Mellon University Software Engineering Institute (2022). SEI: Publications: Digital Library: Search Results: OCTAVE.

¹³³ European Telecommunications Standards Institute, ETSI (2022). Standards: Search: Cybersecurity.

¹³⁴ MONARC (2022). What is MONARC?

¹³⁵ Agence Nationale de la Securite des Systems d’Information, ANSSI (2022). EBIOS Risk Manager – The Method.

¹³⁶ Portal Administración Electrónica (2022). The Portal E-government: Cover Page of Documentation: Cover of Methodologies and Guidelines: Metodología de Análisis y Gestión de Riesgos de los Sistemas de Información.

¹³⁷ European Commission (2022). Home: Departments and Executive Agencies: Informatics.

¹³⁸ The Open Group (2022). Risk Analysis.

¹³⁹ ENISA (2022a), p. 31.

¹⁴⁰ ENISA (2022b, Jan). Interoperable EU Risk Management Framework: Methodology for and assessment of interoperability among risk management frameworks and methodologies. Attiki, GR: Author.

¹⁴¹ Ibid., pp. 6-12.

¹⁴² Ibid., pp. 24-25

¹⁴³ JTF (2018, Dec).

¹⁴⁴ Caralli, R., Stevens, J., Young, L., and Wilson, W. (2007, May). Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process (CMU/SEI-2007-TR-012). Pittsburgh: Carnegie Mellon University.

¹⁴⁵ Alberts, C., Dorofee, A., Stevens, J., and Woody, C. (2005, Jan). OCTAVE®-S Implementation Guide, Version 1.0 (CMU/SEI-2003-HB-003). Pittsburgh: Carnegie Mellon University.

¹⁴⁶ ISO/IEC (2018). Information Technology – Security Techniques – Information Security Risk Management (ISO/IEC 27005:2018). Geneva: Author.

¹⁴⁷ CASES (2016, Apr). MONARC Version 1.0. Luxembourg: Author.

¹⁴⁸ Tucker, B. (2020, Nov). Advancing Risk Management Capability Using the OCTAVE FORTE Process (CMU/SEI-2020-TN-002). Pittsburgh: Carnegie Mellon University.

¹⁴⁹ The Open Group (2021, Nov). Risk Analysis (O-RA), Version 2.0.1. Berkshire, UK: Author.

¹⁵⁰ BSI (2017, Oct). IT-Grundschutz Methodology (BSI-Standard 200-2). Bonn: Author.

¹⁵¹ Baltic and International Maritime Council, BIMCO (2020). The Guidelines on Cybersecurity Onboard Ship, Version 4.0.

¹⁵² JTF TI (2011, Mar).

¹⁵³ ANNSI (2022).

¹⁵⁴ ETSI (2017, Oct). CYBER; Methods and protocols; Part 1: Method and pro forma for Threat, Vulnerability, Risk Analysis (TVRA) (ETSI TS 102 165-1 V5.2.3). Sophia Antipolis Cedex, FR: Author.

¹⁵⁵ Portal Administración Electrónica (2022).

¹⁵⁶ European Commission (2020, 8 Nov). IT Security Risk Management Methodology v1.2: Description of the Methodology (v1.2 r19).

¹⁵⁷ JTF TI (2012, Sep).

¹⁵⁸ Club de la Sécurité de l’Information Français, CLUSIF (2022). Reception: Services: Risk Management: The Fundamentals of MÉHARI (Google Translation).