User Risk

What happens after a system is authorized?

The controls have been assessed. The vulnerabilities have been documented. The security plan is complete. The Authorizing Official accepts the residual risk, and the system receives its Authorization to Operate.

Then people begin making decisions.

Users respond to suspicious messages. Administrators grant privileges. Engineers decide when to patch. Security teams interpret alerts. Leaders approve exceptions. Under pressure, people make choices that can preserve the effectiveness of security controls or quietly undermine them.

Yet one critical variable remains largely unmeasured: Human Judgment.

User Risk: The Missing Variable in the Risk Management Framework challenges cybersecurity leaders to reconsider what they know about risk after authorization.

Drawing on more than 30 years of cybersecurity leadership experience, Dr. James W. Howell Jr. introduces User Risk as a measurable operational variable that influences control effectiveness, Operational Trust, and mission assurance.

Building on the NIST Risk Management Framework, the book introduces original concepts including Operational Trust, Behavioral Evidence, User Risk Indicators, and the User Risk Measurement Lifecycle. Together, they provide a structured approach for examining how human decisions affect security controls during real-world operations.

Through analysis of major cyber incidents, governance principles, and practical application, User Risk exposes the gap between demonstrating that controls are implemented and understanding what happens when people must operate them under pressure, ambiguity, and competing mission demands.

Written for Authorizing Officials, CIOs, CISOs, RMF practitioners, cybersecurity professionals, auditors, risk managers, and executive leaders responsible for consequential risk decisions.

If we measure every other dimension of cybersecurity risk, why wouldn't we measure the people whose decisions ultimately determine whether trust is preserved?