Definition

Operational risk assessment identifies and models the vulnerabilities of, and risks to, an organization's activities individually and as a whole.

References

Reference - MGT516: Managing Security Vulnerabilities: Enterprise and Cloud Reference - NIST RMF Quick Start Guide - Assess Step - Frequently Asked Questions (FAQ) Reference - NIST Special Publication 800-160 Volume 1 - System Security Engineering Reference - NIST Special Publication 800-37 Revision 2 - Risk Management Framework for Information Systems and Organizations Reference - NIST Special Publication 800-53A Revision 5 - Assessing Security and Privacy Controls in Information Systems and Organizations Reference - NISTIR 8011 Volume 1 - Automation Support for Security Control Assessments