Written and maintained by CASRAI Editorial Board
Last updated
NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments, is the National Institute of Standards and Technology’s guidance on how to carry out an information security risk assessment. It sets out a four-step process of 15 tasks (prepare, conduct, communicate, maintain) and deliberately leaves the scoring scales, tools and report format to each organization. The details below are as described on NIST’s official pages on 2026-10-29.
What NIST SP 800-30 is and who publishes it
SP 800-30 Rev. 1 is a Special Publication from NIST’s Computer Security Resource Center (CSRC), written by the Joint Task Force Transformation Initiative and issued in September 2012. As described on the official CSRC page on 2026-10-29, it is listed as “Final” and supersedes the original SP 800-30 of July 2002. Its stated purpose is “to provide guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance in Special Publication 800-39.”
The publication defines risk as “a measure of the extent to which an entity is threatened by a potential circumstance or event,” typically a function of (i) the adverse impacts that would arise if the event occurs and (ii) the likelihood of occurrence. Everything else in the guide is machinery for estimating those two quantities in a way decision makers can use.
Who it applies to
The guide is written for federal information systems and organizations, and its audience section lists people with roles such as mission and business owners, authorizing officials, acquisition and procurement officials, system and security engineers, chief information officers, senior information security officers and system owners. It is guidance, not a funding program: nothing in it is applied for or awarded. Research institutions meet it indirectly, for example when a sponsor or contract points to NIST guidance, or when a security office adopts its vocabulary voluntarily. For a related NIST publication that research institutions meet through contract terms, see CASRAI’s entry on NIST SP 800-171.
The assessment can be done at any of the three tiers of the risk management hierarchy that SP 800-39 describes: Tier 1 (organization), Tier 2 (mission and business processes) and Tier 3 (information systems). Results are communicated up and down the tiers; for example, Tier 3 results go to Tier 1 and Tier 2.
What it requires, and what it leaves open
This is the part most summaries skip. SP 800-30 states that there are no specific requirements for (i) the formality, rigor or level of detail of an assessment, (ii) the methodologies, tools and techniques used, or (iii) the format and content of results. Its tables are described as exemplary: the threat-source taxonomy (Appendix D), threat events (E), vulnerabilities and predisposing conditions (F), likelihood scales (G), impact scales (H) and risk determination tables (I) are starting points an organization tailors, not mandatory forms.
What the guide does ask for is a defensible chain of reasoning: a stated purpose and scope, explicit assumptions, named information sources, a chosen risk model, and documented rationale for each judgment. It also says organizations should make uncertainty in their risk determinations explicit.
Quantitative, qualitative or semi-quantitative
The guide describes three analytic approaches and says the choice depends on organizational culture, especially attitudes toward uncertainty and risk communication. Qualitative assessments use categories such as very low, low, moderate, high and very high. Semi-quantitative assessments use bins or scales, for example 0-100, that translate to those categories; the exemplary tables in Appendix D pair five qualitative levels with value ranges (very low 0-4, low 5-20, moderate 21-79, high 80-95, very high 96-100). Purely quantitative assessments are possible but, the guide notes, rigor is lessened when subjective judgments are buried inside numbers.
The four steps and 15 tasks
The guide says the risk assessment process is composed of four steps. Each step is divided into tasks, 15 in total. The table shows what each task decides.
| Step | Task | What it decides |
|---|---|---|
| 1. Prepare for the assessment | 1-1 | Purpose: the information the assessment produces and the decisions it supports |
| 1-2 | Scope: organizational applicability, time frame, architectural and technology considerations | |
| 1-3 | Assumptions and constraints under which the assessment is conducted | |
| 1-4 | Sources of descriptive, threat, vulnerability and impact information | |
| 1-5 | The risk model and analytic approach | |
| 2. Conduct the assessment | 2-1 | Threat sources of concern, including capability, intent and targeting (Appendix D) |
| 2-2 | Potential threat events and their relevance (Appendix E) | |
| 2-3 | Vulnerabilities and predisposing conditions (Appendix F) | |
| 2-4 | Likelihood that threat events result in adverse impacts (Appendix G) | |
| 2-5 | Adverse impacts from threat events (Appendix H) | |
| 2-6 | Risk, from impact and likelihood (Appendix I; prioritization in Appendix J) | |
| 3. Communicate results | 3-1 | Communicate results to decision makers; Appendix K gives an example of what a report may contain |
| 3-2 | Share risk-related information with appropriate personnel | |
| 4. Maintain the assessment | 4-1 | Ongoing monitoring of the risk factors that change risk |
| 4-2 | Update the existing assessment from monitoring results |
Likelihood is treated differently by threat type. For adversarial threats it draws on the threat source’s capability, intent and targeting plus the vulnerabilities present; the guide’s tasks then combine initiation likelihood with the likelihood that an initiated event has adverse impact into an overall likelihood. Each of the Task 2-1 to 2-6 outputs feeds the risk tables in Appendix I.
Typical phases of an assessment
The four steps are the phases. The guide describes the process as ongoing rather than a one-time exercise: the fourth step exists to keep the organization’s specific knowledge of its risk current, using risk monitoring to determine the effectiveness of risk responses, identify risk-impacting changes to systems and their environments, and verify compliance. The guide also says risk assessments can be tailored to the steps of the Risk Management Framework described in SP 800-37, and it leaves the update frequency to the organization.
Common mistakes
- Treating the appendix tables as required forms. The guide calls them exemplary and says organizations tailor or truncate them, for example by dropping threat sources outside the assessment’s scope.
- Scores without reasons. The guide says repeatability of qualitative assessments increases when values are annotated with the reasons behind them, and that different experts can otherwise produce significantly different results.
- False precision. It warns that quantification loses rigor when subjective determinations are buried inside numbers or when significant uncertainty surrounds the values.
- Assuming risk can never exceed impact. The guide says risk is typically not higher than the impact level, but when many moderate risks materialize together at the organization-wide level that bound may not hold.
- Stopping after the report. Steps 3 and 4 (communicating and maintaining) are part of the process, not extras.
Related NIST publications
| Publication | Relationship stated in SP 800-30 Rev. 1 |
|---|---|
| SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View | Describes the overall risk management process and the three-tier hierarchy that SP 800-30 builds on; a footnote in SP 800-30 states that 800-39 supersedes 800-30 as the primary source for guidance on information security risk management |
| SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems | Defines the Risk Management Framework; risk assessment activities can be integrated with its steps |
| SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations | Listed in the guide’s references as the source of security controls; the edition cited in the 2012 text is Revision 3, so the current edition of 800-53 should be checked on CSRC |
For frameworks outside the information-systems setting, CASRAI covers NIST’s Govern, Map, Measure, Manage functions and a practical AI risk assessment framework and risk register. For the broader topic, see What Is Cybersecurity? and the entry on research security.
FAQ
Is NIST SP 800-30 still current?
As described on the official CSRC page on 2026-10-29, Revision 1 (September 2012) is listed as Final and no withdrawal notice appears on that page. Its own footnote points to SP 800-39 as the primary source for information security risk management guidance, with 800-30 supplying the assessment detail.
How many steps does the risk assessment process have?
Four: prepare for the assessment, conduct the assessment, communicate the results, and maintain the assessment. They are divided into 15 tasks.
Does SP 800-30 tell me which scoring scale to use?
No. It provides exemplary qualitative and semi-quantitative scales and says there are no specific requirements for methods, tools, level of detail or report format.
Can I use it outside the US federal government?
The publication is written for federal information systems and organizations. Nothing in it restricts other organizations from adopting its process, and it leaves the choice of methods to the organization, but any obligation to follow it comes from outside the document, such as a contract or policy.
Sources
- NIST CSRC, SP 800-30 Rev. 1 (Final): csrc.nist.gov/pubs/sp/800/30/r1/final, checked 2026-10-29.
- NIST, Guide for Conducting Risk Assessments, full text (PDF): nvlpubs.nist.gov, checked 2026-10-29. DOI: 10.6028/NIST.SP.800-30r1.
- NIST publication record: nist.gov/publications/guide-conducting-risk-assessments, checked 2026-10-29.
