Guide for Conducting Risk Assessments

Published

September 17, 2012

Author(s)

Ronald S. Ross

Abstract

The purpose of Special Publication 800-30 is to provide guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance provided in Special Publication 800-39. This document provides guidance for carrying out each of the three steps in the risk assessment process (i.e., prepare for the assessment, conduct the assessment, and maintain the assessment) and how risk assessments and other organizational risk management processes complement and inform each other. [Supersedes SP 800-30 (July 2002): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=151254]

Citation

Special Publication (NIST SP) - 800-30 Rev 1

Report Number

800-30 Rev 1

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Supercedes Publication

Risk Management Guide for Information Technology Systems

Download Paper

DOI Link

Keywords

analysis approach, monitoring risk, risk assessment, risk management, Risk Management Framework, risk model, RMF, threat sources

Citation

Ross, R. (2012), Guide for Conducting Risk Assessments, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-30r1 (Accessed April 23, 2026)

Additional citation formats