dod-rio

Score likelihood 1-5 against probability bands and consequence 1-5 as the maximum of cost, schedule, and performance impacts, assessed unmitigated with fully burdened costs. A KPP or APB threshold breach forces a Level 5 performance rating, and fractional scores are not allowed.

The four options are Accept (track as a Watch Item), Avoid (alternate path or deferral), Transfer (reassign via MOA/MOU, which never fully removes Government exposure), and Control (actively reduce likelihood or consequence). High and moderate risks require a six-step burn-down plan loaded into the IMS.

A risk is a possible future event characterized by likelihood and consequence, while an issue has already occurred or is certain (probability = 1) and is scored on consequence only. Issues use a parallel process with Ignore or Control options and a corrective action plan with an EAC.

No. It summarizes RMF, Cyber Table Top, FMECA, and similar methods as risk sensors feeding the enterprise register, but defers depth to their own authorities such as DoDI 8510.01 and MIL-STD-882. Use dedicated packs like nist-800-37 or mil-std-882 for those regimes.

Each pathway pre-sets the risk posture: UCA accepts deficiencies for speed, MTA fails early and descopes, MCA front-loads decisions and burns down risk in TMRR, Software builds automation up front, DBS uses fit-gap analysis, and Services treat the requirement as the risk.