RA-1 Policy and Procedures is the paperwork behind every other risk assessment control. NIST 800-53 binds US federal systems, and other organizations through contracts. For everyone else it is a reference, and almost every framework you meet will ask for something similar.
What it means in practice
The statement asks you to develop, document and disseminate a risk assessment policy to the people you define. It covers purpose, scope, roles, responsibilities, management commitment, coordination and compliance, and must be consistent with applicable law. You also need procedures to implement the policy and the RA controls. A designated official manages them. Both are reviewed and updated on a schedule you define, and after events you define.
The guidance says security and privacy programs should write these together, and that organization level policy is generally preferable to one per system.
Evidence to collect
- The policy and procedures, with owner, version and approval date.
- Proof of distribution, such as acknowledgments.
- The designation of the managing official.
- Review history for the last cycle.
Common gaps
- A policy exists, but no procedure says how to run an assessment.
- No named owner.
- Review dates have passed.
How to implement it
Write the policy in two pages. Write the procedure as steps: scope, identify threats, rate likelihood and impact, record, review. Set an annual review and log each one.
Quick check
Do we need a separate policy for each system?
No. The guidance prefers one at the organization level, with system level procedures only where needed.
