NIST SP 800-30
NIST Special Publication 800-30 Revision 1, "Guide for Conducting Risk Assessments", published September 2012, is the US federal method for assessing information security risk.
It breaks an assessment into preparing (purpose, scope, assumptions, sources), conducting (identify threat sources and events, vulnerabilities and predisposing conditions, likelihood, impact, and resulting risk), communicating results, and maintaining the assessment over time, and it supplies the reference tables for likelihood and impact scales that many organizations still copy.
It is one of the Joint Task Force documents that support the Risk Management Framework, so it is used wherever NIST SP 800-37 and 800-53 are used, including FedRAMP and FISMA, and it is a common template for the risk assessment required by HIPAA, NIST SP 800-171, and ISO/IEC 27001 programs. There is no certification against it.
In writing it yields a risk assessment plan, the completed assessment report with its threat, vulnerability, likelihood, and impact tables, and a maintenance schedule.
help
Who has to comply
Mandatory in substance for US federal agencies under FISMA; voluntary for others. Contractors and cloud providers use it because FedRAMP, CMMC, and agency assessors expect risk assessments in this shape.
What the assessor asks to see
Risk assessment plan and scope; threat source and event catalog; vulnerability and predisposing condition inventory; likelihood and impact determinations with rationale; risk register or heat map; communication record to decision makers; maintenance and update log.
Who helps with NIST SP 800-30
Every security consultancy offers risk assessments modeled on it; GRC platforms embed its scales. Engagements are typically two to eight weeks.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first NIST SP 800-30 consultant listed here
The people reading this are working out who can help them get there.
Who assesses NIST SP 800-30
None for the document itself. Risk assessments produced with it are reviewed by whichever assessor governs the parent program (3PAOs, C3PAOs, agency assessors, ISO certification bodies).
Assessors
Be the first NIST SP 800-30 assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for NIST SP 800-30
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads.
GRC and compliance automation1 tool
Controls, evidence and audit workflows, with a policy module inside.
Need a hand implementing it?
Find a Consultant for NIST SP 800-30
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with NIST SP 800-30
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.