RISK MANAGEMENT PLAN
PURPOSE AND SCOPE
The purpose of the Risk Management Plan is to establish an approach to monitoring, evaluating, and managing risks throughout the life of the project. A risk is an uncertain event or condition that has a negative or positive effect on the project’s objectives.
The risk management plan will identify potential risk, assess individual risk and its impact on performance, cost, and schedule of the overall project and develop an action plan that handles individual risk.
RISK PLAN OBJECTIVES
The scope of this risk assessment assessed the system’s use of resources and controls (implemented or planned) to eliminate and/or manage vulnerabilities exploitable by threats internal and external to the Project. If exploited, these vulnerabilities could result in:
• Unauthorized disclosure of data
• Unauthorized modification to the system, its data, or both
• Denial of service, access to data, or both to authorized users
This Risk Assessment Report evaluates the confidentiality (protection from unauthorized disclosure of system and data information), integrity (protection from improper modification of information), and availability (loss of system access) of the system. Recommended security safeguards will allow management to make decisions about security-related initiatives.

PROJECT RISKS
This risk assessment methodology and approach was conducted using the guidelines in NIST SP 800-30, Risk Management Guide for Information Technology Systems. The assessment is broad in scope and evaluates security vulnerabilities affecting confidentiality, integrity, and availability. The assessment recommends appropriate security safeguards, permitting management to make knowledge-based decisions about security-related initiatives. The methodology addresses the following types of controls:
• Management Controls: Management of the