NIST SP 800-30 Rev. 1

Why does it matter?

NIST SP 800-30 Rev. 1 turns risk assessment from an opinion into a repeatable analysis that leaders can compare across systems, business processes and time. Section 2.3 asks organizations to make their risk model, assessment approach and analysis approach explicit and to record a rationale for every assessed value, so that different experts reach the same result from the same data (reproducibility) and a later assessment can be compared with an earlier one (repeatability). The appendices supply five-level scales from Very Low to Very High for likelihood, impact and risk, so a rating can be traced to the table it came from.

Key benefits include:

• A common risk vocabulary

Threat sources, threat events, vulnerabilities, predisposing conditions, likelihood and impact are defined in Section 2.3.1 and the Appendix B glossary and used the same way in every assessment.

• Assessments at every tier

Section 2.4 applies the same process at Tier 1 (organization), Tier 2 (mission/business process) and Tier 3 (information system), so results roll up and inform each other.

• Defensible risk ratings

Assessment scales in Tables G-2 to G-5 (likelihood), H-3 (impact) and I-2 and I-3 (risk) let teams show how each rating was reached.

• Direct input to the RMF

Appendix K describes how an initial assessment informs the tailoring of control baselines and how later assessments inform authorization decisions under SP 800-37.

• Living assessments

Tasks 4-1 and 4-2 keep an assessment current through ongoing monitoring of the risk factors instead of treating it as a one-time report.

How does it work?

The guide has three chapters and twelve appendices. Chapter One sets purpose, applicability and audience. Chapter Two gives the fundamentals: the four components of risk management taken from SP 800-39 (frame, assess, respond, monitor; Section 2.1), the risk model (2.3.1), the assessment approach, which is quantitative, qualitative or semi-quantitative (2.3.2), the analysis approach, which is threat-oriented, asset/impact-oriented or vulnerability-oriented (2.3.3), and the application of assessments at the three tiers (2.4). Chapter Three describes the process. Appendices D to I give inputs, taxonomies, assessment scales and templates; Appendix J covers informing risk response, Appendix K the risk assessment report and Appendix L the summary of tasks (Table L-1).

The process has four steps and 15 tasks. Prepare (Section 3.1): identify the purpose (Task 1-1), the scope (1-2), the assumptions and constraints (1-3), the information sources (1-4) and the risk model and analytic approach (1-5). Conduct (3.2): identify threat sources (2-1), threat events (2-2) and vulnerabilities and predisposing conditions (2-3), then determine likelihood (2-4), impact (2-5) and risk (2-6). Communicate (3.3): report results to decision makers (3-1) and share risk-related information (3-2). Maintain (3.4): monitor the risk factors (4-1) and update the assessment (4-2).

The appendices make the method concrete. Table D-2 sorts threat sources into adversarial, accidental, structural and environmental types; Tables E-2 and E-3 list representative adversarial and non-adversarial threat events; Table F-4 is a taxonomy of predisposing conditions. Likelihood is rated on Tables G-2 to G-4 and combined in Table G-5, impact on Table H-3, and Table I-2 combines likelihood and impact into a level of risk on the five-point scale of Table I-3, where High means a severe or catastrophic adverse effect and Very High multiple severe or catastrophic effects. Appendix K sets the essential elements of the report: an executive summary, the body and supporting appendices.

Key Elements

• Risk model (Section 2.3.1)

Defines the risk factors to assess (threat, vulnerability, impact, likelihood and predisposing condition) and the relationships among them, so every assessment analyzes the same things.

• Assessment and analysis approaches (Sections 2.3.2 and 2.3.3)

Organizations choose quantitative, qualitative or semi-quantitative values and a threat-, asset/impact- or vulnerability-oriented starting point, then apply them consistently.

• Three-tier hierarchy (Section 2.4)

Assessments are conducted at the organization, mission/business process and information system levels, with results flowing between tiers.

• Four-step process (Chapter Three)

Prepare, conduct, communicate and maintain, with 15 numbered tasks from Task 1-1 to Task 4-2, give every assessment the same structure from scoping to ongoing update.

• Threat and vulnerability taxonomies (Appendices D, E and F)

Tables D-2, E-2, E-3 and F-4 list adversarial and non-adversarial threat sources, threat events, and vulnerabilities and predisposing conditions to draw from.

• Likelihood, impact and risk scales (Appendices G, H and I)

Tables G-2 to G-5, H-3, I-2 and I-3 provide the rating scales and combination tables used to determine the level of risk, with templates for adversarial and non-adversarial risk (Tables I-5 and I-7).

• Risk assessment report (Appendix K)

The executive summary states the date, purpose, scope, overall level of risk and the number of risks at each level; the body records assumptions, risk tolerance, the risk model, uncertainties and the results.

What does it cover?

SP 800-30 Rev. 1 applies to risk assessments of federal information systems and organizations, at all three tiers of the risk management hierarchy and throughout the system development life cycle (Sections 1.1 and 2.4). Section 1.1 excludes national security systems unless federal officials with policy authority approve its use, and encourages state, local and tribal governments and private sector organizations to use it. It covers information security risk arising from the operation and use of information systems; it does not itself select or specify security controls, which is the role of NIST SP 800-53, nor does it set the organization-wide risk management strategy, which SP 800-39 describes.

What are its objectives?

The guide exists so that organizations can assess risk in a way that is consistent, repeatable and useful to the people who decide how to respond (Section 1.1):

Give senior leaders and executives the information needed to determine appropriate courses of action in response to identified risks.

Provide guidance for each of the four steps of the risk assessment process and show how assessments and other risk management processes inform each other.

Support risk assessment at the organization, mission/business process and information system tiers (Section 2.4).

Make assessments reproducible and repeatable by requiring an explicit risk model, assessment approach, analysis approach and a rationale for assessed values (Section 2.3).

Identify the risk factors to monitor on an ongoing basis so the organization knows when risk exceeds its tolerance (Section 1.1 and Task 4-1).

Communicate results in a form decision makers can use, through the Appendix K report elements.

Framework in Context

SP 800-30 Rev. 1 amplifies the guidance in NIST SP 800-39, which sets the organization-wide approach to managing information security risk and whose four components frame, assess, respond and monitor appear in Section 2.1. It supplies the risk assessment that NIST SP 800-37 Rev. 2, the Risk Management Framework, calls for at the organization and system levels. Appendix K says an initial assessment can be used to tailor security control baselines and that later assessments incorporate control assessment results, inform authorization decisions, support the analysis of risk responses and absorb what is learned from incidents. The 2012 edition remains the current one; NIST lists no later revision.

Common Framework Mappings

NIST SP 800-30 Rev. 1 is commonly mapped to the NIST risk management publications it supports and to the international risk management standards that describe the same assessment activities.

Mapped frameworks include:

NIST 800-37 Rev.2

NIST SP 800-39

NIST CSF 2.0

NIST 800-53 Rev.5 Baselines

ISO 27005:2022

ISO 31000:2018