Full color, illustrated publication. The purpose of this handbook is to provide guidance for implementing the Risk Management (RM) requirements of NASA Procedural Requirements (NPR) document NPR 8000.4A, Agency Risk Management Procedural Requirements [1], with a specific focus on programs and projects, and applying to each level of the NASA organizational hierarchy as requirements flow down. This handbook supports RM application within the NASA systems engineering process, and is a complement to the guidance contained in NASA/SP-2007-6105, NASA Systems Engineering Handbook [2]. Specifically, this handbook provides guidance that is applicable to the common technical processes of Technical Risk Management and Decision Analysis established by NPR 7123.1A, NASA Systems Engineering Process and Requirements [3]. These processes are part of the \Systems Engineering Engine. (Figure 1) that is used to drive the development of the system and associated work products to satisfy stakeholder expectations in all mission execution domains, including safety, technical, cost, and schedule. Like NPR 7123.1A, NPR 8000.4A is a discipline-oriented NPR that intersects with product-oriented NPRs such as NPR 7120.5D, NASA Space Flight Program and Project Management Requirements [4]; NPR 7120.7, NASA Information Technology and Institutional Infrastructure Program and Project Management Requirements [5]; and NPR 7120.8, NASA Research and Technology Program and Project Management Requirements [6]. In much the same way that the NASA Systems Engineering Handbook is intended to provide guidance on the implementation of NPR 7123.1A, this handbook is intended to provide guidance on the implementation of NPR 8000.4A. 1.2

This book is in full-color - other editions may be in grayscale (non-color). The hardback version is ISBN 9781680920512 and the paperback version is ISBN 9781680920505. The NASA Space Flight Program and Project Management Handbook (NASA/SP-2014-3705) is the companion document to NPR 7120.5E and represents the accumulation of knowledge NASA gleaned on managing program and projects coming out of NASA's human, robotic, and scientific missions of the last decade. At the end of the historic Shuttle program, the United States entered a new era that includes commercial missions to low-earth orbit as well as new multi-national exploration missions deeper into space. This handbook is a codification of the "corporate knowledge" for existing and future NASA space flight programs and projects. These practices have evolved as a function of NASA's core values on safety, integrity, team work, and excellence, and may also prove a resource for other agencies, the private sector, and academia. The knowledge gained from the victories and defeats of that era, including the checks and balances and initiatives to better control cost and risk, provides a foundation to launch us into an exciting and healthy space program of the future.

In some form, risk management (RM) has always been an integral part of virtually every challenging human endeavor. A formal and, at that time, qualitative RM process known as Continuous Risk Management (CRM) was introduced to NASA in the latter half of the 1990s. More rigorous quantitative RM processes including Risk-Informed Decision Making (RIDM) and an enhanced version of CRM have only recently been developed for implementation as an integral part of systems engineering at NASA. While there will probably always be vigorous debate over the details of what comprises the best approach to managing risk, few will disagree that effective risk management is critical to program and project success and affordability. Since their introduction and until recently, NASA RM processes have been based on CRM, which stresses the management of risk during the Implementation phase of the NASA Program Project Life Cycle. In December of 2008, NASA issued NPR 8000.4A, which introduced RIDM as a complementary process to CRM that is concerned with analysis of important and or direction-setting decisions. In the past, RM was considered equivalent to CRM; now, RM is defined as comprising both CRM and RIDM. In April 2010, NASA issued NASA SP-2010-576, the NASA Risk-Informed Decision Making Handbook. This handbook introduced RIDM as the front-end of the RM process, described the details of how RIDM is conducted, and ended with a description of how the results of RIDM transition to and set the stage for CRM, the final portion of the RM process. The RIDM Handbook did not proceed to describe CRM, as the development of an enhanced version of CRM was still a work in progress in 2010. Now this handbook addresses the entirety of the NASA RM process, including both RIDM and CRM. The purpose of this handbook is to provide guidance for implementing the Risk Management (RM) requirements of NASA Procedural Requirements (NPR) document NPR 8000.4A, Agency Risk Management Procedural Requirements, with a specific focus on programs and projects, and applying to each level of the NASA organizational hierarchy as requirements flow down. This handbook supports RM application within the NASA systems engineering process, and is a complement to the guidance contained in NASA SP-2007-6105, NASA Systems Engineering Handbook. Specifically, this handbook provides guidance that is applicable to the common technical processes of Technical Risk Management and Decision Analysis established by NPR 7123.1A, NASA Systems Engineering Process and Requirements. These processes are part of the Systems Engineering Engine that is used to drive the development of the system and associated work products to satisfy stakeholder expectations in all mission execution domains, including safety, technical, cost, and schedule.

System safety is the application of engineering and management principles, criteria, and techniques to optimize safety within the constraints of operational effectiveness, time, and cost throughout all phases of the system life cycle. System safety is to safety as systems engineering is to engineering. When performing appropriate analysis, the evaluation is performed holistically by tying into systems engineering practices and ensuring that system safety has an integrated system-level perspective.The NASA System Safety Handbook presents the overall framework for System Safety and provides the general concepts needed to implement the framework. The treatment addresses activities throughout the system life cycle to assure that the system meets safety performance requirements and is as safe as reasonably practicable.This handbook is intended for project management and engineering teams and for those with review and oversight responsibilities. It can be used both in a forward-thinking mode to promote the development of safe systems, and in a retrospective mode to determine whether desired safety objectives have been achieved.The topics covered in this volume include general approaches for formulating a hierarchy of safety objectives, generating a corresponding hierarchical set of safety claims, characterizing the system safety activities needed to provide supporting evidence, and presenting a risk-informed safety case that validates the claims. Volume 2, to be completed in 2012, will provide specific guidance on the conduct of the major system safety activities and the development of the evidence.

Managing Information Risks: Threats, Vulnerabilities, and Responses identifies and categorizes risks related to creation, collection, storage, retention, retrieval, disclosure and ownership of information in organizations of all types and sizes. It is intended for risk managers, information governance specialists, compliance officers, attorneys, records managers, archivists, and other decision-makers, managers, and analysts who are responsible for risk management initiatives related to their organizations’ information assets. An opening chapter defines and discusses risk terminology and concepts that are essential for understanding, assessing, and controlling information risk. Subsequent chapters provide detailed explanations of specific threats to an organization’s information assets, an assessment of vulnerabilities that the threats can exploit, and a review of available options to address the threats and their associated vulnerabilities. Applicable laws, regulations, and standards are cited at appropriate points in the text. Each chapter includes extensive endnotes that support specific points and provide suggestions for further reading. While the book is grounded in scholarship, the treatment is practical rather than theoretical. Each chapter focuses on knowledge and recommendations that readers can use to: heighten risk awareness within their organizations, identify threats and their associated consequences, assess vulnerabilities, evaluate risk mitigation options, define risk-related responsibilities, and align information-related initiatives and activities with their organizations’ risk management strategies and policies. Compared to other works, this book deals with a broader range of information risks and draws on ideas from a greater variety of disciplines, including business process management, law, financial analysis, records management, information science, and archival administration. Most books on this topic associate information risk with digital data, information technology, and cyber security. This book covers risks to information of any type in any format, including paper and photographic records as well as digital content.

Every day in the United States, over two million men, women, and children step onto an aircraft and place their lives in the hands of strangers. As anyone who has ever flown knows, modern flight offers unparalleled advantages in travel and freedom, but it also comes with grave responsibility and risk. For the first time in its history, the Federal Aviation Administration has put together a set of easy-to-understand guidelines and principles that will help pilots of any skill level minimize risk and maximize safety while in the air. The Risk Management Handbook offers full-color diagrams and illustrations to help students and pilots visualize the science of flight, while providing straightforward information on decision-making and the risk-management process.