NIST Special Publication 800-30 is the US National Institute of Standards and Technology’s guide to conducting information security risk assessments. It explains how to prepare for an assessment, carry it out, communicate the results and keep them current, using a consistent set of risk factors: threats, vulnerabilities, predisposing conditions, likelihood and impact. It was written for federal agencies, but many private organizations, auditors and consultants use it as a recognizable, defensible method. This entry is general information, not legal advice.
At a glance
- It is a how-to guide for risk assessments, not a control catalog or a certification.
- The current revision, Revision 1 (2012), lays out four steps: prepare, conduct, communicate and maintain.
- It describes risk in terms of threat sources and events, vulnerabilities and predisposing conditions, likelihood and impact.
- Assessments can be done at three tiers: organization, mission or business process, and information system.
- It is widely referenced outside government because it is free and well known.
What problem it solves
Many organizations run risk assessments that can’t be compared from one year to the next. One consultant uses a five-point scale, the next uses a heat map with different definitions, and the internal team uses gut feel. Leadership gets ratings it can’t trust, and spending follows whichever risk sounds scariest.
NIST SP 800-30 gives a common method. It defines what goes into a rating, how to describe threats and weaknesses, and how to explain uncertainty, so different assessors working at different times reach results that can be compared and challenged. For buyers, it also gives a yardstick for judging an assessment a provider or advisor delivers: you can ask whether it followed a recognized method and see whether the work shows each step.
How it works
Prepare. The assessor sets the purpose, scope, assumptions and constraints, decides which sources of threat and vulnerability information to use, and chooses the risk model and analysis approach. The guide describes threat-oriented, asset or impact-oriented and vulnerability-oriented approaches.
Conduct. The assessor identifies threat sources and the events they could cause, finds vulnerabilities and predisposing conditions (such as a facility’s location or reliance on a single supplier), estimates how likely each event is to occur and succeed, estimates the impact, and combines likelihood and impact into a risk rating.
Communicate. Results are shared with the decision-makers who need them, in a form that supports a decision rather than only listing findings.
Maintain. The assessment is updated as threats, systems and the business change, often through ongoing monitoring of the key risk factors.
Scales. Ratings can be quantitative, qualitative (for example, very low to very high) or semi-quantitative. Results often feed a risk register and the control decisions made using the NIST Risk Management Framework (NIST RMF) and the NIST SP 800-53 control catalog.
Risk tiers and assessment steps
NIST SP 800-30 has no compliance levels. Its structure is the three tiers at which an assessment can be run and the four steps of the process it describes.
| Tier or step | What it covers | Who typically does it | Typical output |
|---|---|---|---|
| Tier 1: Organization | Organization-wide risks, strategy, policy and risk tolerance | Senior leadership, risk and security leaders | Enterprise risk view, inputs to policy and investment |
| Tier 2: Mission or business process | Risks to specific business processes and the systems that support them | Process owners, architects, security team | Process-level priorities and protection needs |
| Tier 3: Information system | Risks to a specific system and its environment | System owners, security team or outside assessor | System risk assessment report, inputs to control selection |
| Step 1: Prepare | Purpose, scope, assumptions, model and sources | Assessment lead | Assessment plan |
| Step 2: Conduct | Threats, vulnerabilities, likelihood, impact, risk | Assessors | Risk ratings with supporting rationale |
| Step 3: Communicate | Sharing results with decision-makers | Assessment lead | Report or briefing |
| Step 4: Maintain | Keeping results current | Risk or security team | Updated assessment and monitoring records |
There is no certification against SP 800-30. A provider or advisor saying its assessment “follows NIST 800-30” is describing its method; ask to see how each step was done.
When it matters for buyers
- When hiring an advisor or virtual CISO for a risk assessment. Ask which method they use; a recognized method makes results easier to defend and compare over time.
- When a regulator, auditor or insurer asks how you assess risk. Naming a published method and showing the steps is a strong answer.
- When working toward federal or defense requirements. Risk assessment is expected under the frameworks used for federal systems, and SP 800-30 is NIST’s own guide to it.
- When comparing GRC platforms. Check whether a tool’s risk scoring can be configured to match your chosen method.
Our governance, risk and compliance overview covers advisors and platforms that run and track risk assessments.
Questions to ask vendors
- Which method does your risk assessment follow, and can you show where each step appears in the deliverable?
- Which tiers does the assessment cover: the whole organization, specific business processes or individual systems?
- What threat and vulnerability sources do you use, and how current are they?
- Which rating scale do you use, and how are likelihood and impact defined?
- How do you document assumptions and uncertainty?
- How will results be kept current after the engagement ends?
How it differs from Risk Assessments
A risk assessment is the general practice of identifying, rating and ranking risks, and it can follow many methods, including ISO/IEC 27005 or an organization’s own approach. NIST SP 800-30 is one specific, published method for doing it, written for federal information systems and widely reused elsewhere. In short, the risk assessment is the activity; SP 800-30 is a guide to doing it in a consistent, defensible way. It sits alongside other NIST publications in the Special Publication 800 series, and its results are often used to set priorities under the NIST Cybersecurity Framework (NIST CSF) or a GRC program.
Problems this helps with
- An auditor or customer wants to know what method our risk assessment follows
- Every risk assessment we get uses a different scale, so results can't be compared
- Leadership wants risk ratings it can act on, not a list of scary scenarios
