What happens after a system is authorized?
The controls have been assessed. The vulnerabilities have been documented. The security plan is complete. The Authorizing Official accepts the residual risk, and the system receives its Authorization to Operate.
Then people begin making decisions.
Users respond to suspicious messages. Administrators grant privileges. Engineers decide when to patch. Security teams interpret alerts. Leaders approve exceptions. Under pressure, people make choices that can preserve the effectiveness of security controls or quietly undermine them.
Yet one critical variable remains largely unmeasured: Human Judgment.
User Risk: The Missing Variable in the Risk Management Framework challenges cybersecurity leaders to reconsider what they know about risk after authorization.
Drawing on more than 30 years of cybersecurity leadership experience, Dr. James W. Howell Jr. introduces User Risk as a measurable operational variable that influences control effectiveness, Operational Trust, and mission assurance.
Building on the NIST Risk Management Framework, the book introduces original concepts including Operational Trust, Behavioral Evidence, User Risk Indicators, and the User Risk Measurement Lifecycle. Together, they provide a structured approach for examining how human decisions affect security controls during real-world operations.
Through analysis of major cyber incidents, governance principles, and practical application, User Risk exposes the gap between demonstrating that controls are implemented and understanding what happens when people must operate them under pressure, ambiguity, and competing mission demands.
Written for Authorizing Officials, CIOs, CISOs, RMF practitioners, cybersecurity professionals, auditors, risk managers, and executive leaders responsible for consequential risk decisions.
If we measure every other dimension of cybersecurity risk, why wouldn't we measure the people whose decisions ultimately determine whether trust is preserved?
Dr. James W. Howell Jr. is a cybersecurity executive, researcher, published author, retired federal Chief Information Security Officer (CISO), and U.S. Air Force veteran with more than three decades of experience protecting critical information systems and leading enterprise cybersecurity programs.During a career spanning military service, federal leadership, and private industry, he has directed cybersecurity strategy, risk management, governance, workforce development, and digital modernization initiatives supporting national security missions and complex enterprise environments. He served 22 years in the United States Air Force before continuing in senior federal cybersecurity leadership roles, culminating in service as a federal CISO responsible for enterprise cybersecurity oversight, authorization decisions, compliance programs, and organizational risk management.Dr. Howell is the founder and CEO of SmartCIO, LLC, where his research focuses on digital trust, cyber risk, executive accountability, emerging technology, and the human decisions that influence organizational security.His latest research examines a persistent gap in cybersecurity risk management: organizations extensively assess systems, controls, vulnerabilities, and threats, while the risk introduced by individual users often remains difficult to quantify. User Risk: The Missing Variable in the Risk Management Framework brings that question directly into the discussion of cybersecurity governance and organizational risk.
