C1.7 Three tiers

NIST SP 800-39 [20]; NIST IR 8286 Rev. 1 [9]

The component requires that every risk record declare its tier: organization, meaning the enterprise; mission or business process; or system; that roll-up from one tier to the next normalize the records as it goes; and that a record without a tier be rejected as invalid (C1.7) [20] [9]. A risk at the system tier about a payment gateway and a risk at the enterprise tier about settlement are related and are not the same row, and a register that does not say which tier a row belongs to cannot roll up without double counting or roll down without losing the row.

It comes from the information-security cycle's three tiers of 2011, organization, mission and business process, information system, and from the register series' use of the same three as the levels at which a register exists and from which rows are rolled up, normalized as they go, until the enterprise sees a single register and a single profile. Part II noted that the middle tier is named and then neglected in the original, and that in a bank it is where most risk actually lives. What the component reconciles is the practitioner body's three levels, strategic, tactical and operational [6], which are levels of appetite, with the information-security tiers, which are levels of record: chapter 11 kept tier and recorded the levels as an alias, so that the cascade of appetite in C1.4 and the roll-up of the register in C6.1 [9] use the same three steps under one name. The tier is what makes appetite meet the register: a position set per category at the strategic level is compared with exposures rolled up to the organization tier, and a desk limit with exposures at the system tier.