NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, is the most widely referenced method for assessing information security risk. HHS points to it for the HIPAA Security Rule risk analysis, and its structure fits ISO/IEC 27001 and India’s DPDP Act requirements too.
Here is what an assessment following it actually involves.
The four steps
SP 800-30 organises the work into four steps:
- Prepare. Agree the purpose, scope, assumptions, information sources and the risk model, including the scales used for likelihood and impact.
- Conduct. Identify threat sources and events, vulnerabilities and predisposing conditions; determine likelihood and impact; determine the level of risk.
- Communicate. Share the results with decision-makers in a form they can act on.
- Maintain. Keep the assessment current as systems, threats and vendors change.
How risk is rated
Each risk combines likelihood (how probable it is that a threat event happens and causes harm) and impact (how bad the harm would be). SP 800-30 provides five-level qualitative scales, from Very Low to Very High, and a table (Table I-2) that combines the two into a level of risk.
What matters most is that every rating has a written rationale and an evidence reference. A risk rated “High” without explanation will not survive a customer’s or auditor’s questions.
What you receive
A useful assessment produces:
| Deliverable | Purpose |
|---|---|
| Risk assessment report | Scope, method, findings and limitations, for the record |
| Risk register | Every risk with likelihood, impact, level, owner and target date |
| Remediation plan | Fixes sequenced by risk and effort, with quick wins first |
| Executive summary | Two pages leadership can read and act on |
You can see all four in our sample report for a fictional health-tech company.
Risk assessment vs penetration test
They answer different questions:
- A risk assessment asks: across our systems, people, processes and vendors, what could go wrong, how likely is it, and how bad would it be?
- A penetration test asks: can a skilled attacker break into these specific systems right now?
Most growing teams need the risk assessment first. It tells you where a penetration test would be worth the money.
How long it takes
It depends on scope: the number of systems, vendors and data flows. For a small SaaS company with one product, 3–5 weeks is typical.
Next step
If you need a documented assessment for a customer, an investor or a regulator, see our security risk assessment service.
General information, not legal advice.