NIST SP 800-30: The Complete 2026 Risk Assessment Guide

Last updated 2 November 2026

NIST SP 800-30 is the risk assessment methodology that most organisations quote and few actually run as written — because it asks for something harder than a spreadsheet of system vulnerabilities.

It asks you to assess risk at three levels of the organisation, work through fifteen numbered tasks, and produce something a senior executive can act on. Skip any of that and you get a register nobody reads.

This guide covers what the publication actually says: where it stands in 2026, the three tiers, all fifteen tasks, the scoring scales it hands you, the three analysis approaches it offers, and what is sitting unused in its appendices.

What NIST SP 800-30 is

Guide for Conducting Risk Assessments, Revision 1, was published on 17 September 2012 by the Joint Task Force Transformation Initiative, superseding the 2002 original.

Fourteen years on it has not been revised, and that is worth reading correctly. This is not a neglected document — it is a stable one. The methodology it describes has not needed reworking, which is more than can be said for most risk guidance of the same vintage.

Its stated purpose is precise: to provide guidance for conducting risk assessments, amplifying the guidance in SP 800-39. That relationship matters. SP 800-39 describes managing information security risk across an organisation; SP 800-30 is the assessment component within it. Reading 800-30 alone gives you a method without the frame it was designed to sit in.

Where NIST SP 800-30 stands in 2026

Revision 1 is still the current revision. There is no Revision 2, no public draft of one, and no withdrawal notice on the publication page. Anyone telling you the methodology is out of date is describing the publication date, not the content.

What did move in 2026 is the document next to it. SP 800-18 Rev. 2 was finalised on 30 June 2026, replacing a revision that had stood since 2006. It treats a system as carrying three plans — a system security plan, a system privacy plan and a cybersecurity supply chain risk management plan — and recommends consolidating them into one system plan rather than maintaining three documents that drift apart.

That changes what your NIST SP 800-30 output has to feed. The assessment results now land in a plan structure that expects privacy and supply chain risk to be first-class, not appendices.

Publication	Role	Status	Date
SP 800-30 Rev. 1	Guide for Conducting Risk Assessments — the assessment method	Final	17 Sept 2012
SP 800-39	Managing Information Security Risk — the frame 800-30 sits inside	Final	March 2011
SP 800-37 Rev. 2	Risk Management Framework — the lifecycle that calls for the assessment	Final	20 Dec 2018
SP 800-53 Rev. 5	The control catalog you select treatments from	Final	10 Dec 2020
SP 800-18 Rev. 2	System security, privacy and C-SCRM plans — where results land	Final	30 June 2026

The three tiers of NIST SP 800-30

The single most important line in the publication is that risk assessments are carried out at all three tiers in the risk management hierarchy, as part of an overall risk management process, to give senior leaders and executives the information they need to determine appropriate courses of action.

Almost every failed risk programme fails at this point, and it is the clearest sign a team has read NIST SP 800-30 without running it. The assessment happens at Tier 3 — this system, these vulnerabilities, this patch level — and the output is a technical list. It is accurate, it is diligent, and it cannot answer a question a board actually asks, because board questions live at Tier 1.

Running the assessment at Tier 1 and Tier 2 as well is what turns a vulnerability list into a decision-support document. It is also the part that requires talking to people outside the security team.

Tier	What the assessment covers	The decision it supports
Tier 1 — Organisation	Risk strategy, risk tolerance, governance structures, investment priorities	Whether the organisation accepts the aggregate exposure it is carrying
Tier 2 — Mission and business process	Process design, information flows, enterprise architecture segments, supplier dependencies	Which processes carry risk the organisation cannot absorb, and whether to redesign them
Tier 3 — Information system	Systems, components and their environments of operation	Which specific weaknesses to treat, and in what order

Read the NIST SP 800-30 tiers top down, not bottom up. A Tier 3 finding only earns priority because of something a Tier 1 or Tier 2 assessment established.

The NIST SP 800-30 four-step process

The NIST SP 800-30 method itself is deliberately simple, and the value is in the discipline rather than the complexity:

1. Prepare — establish the purpose, scope, assumptions, constraints, information sources and the risk model and analytic approach you will use. Doing this explicitly is what makes assessments comparable to each other later.
2. Conduct — identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, and determine risk.
3. Communicate and share — give the results to the people who make decisions, in terms they use, and share the underlying risk information with everyone who needs it.
4. Maintain — keep the assessment current as the environment changes.

Two of the four NIST SP 800-30 steps are routinely skipped. Prepare gets skipped because it feels like paperwork before the real work, and its absence is why two assessments in the same organisation cannot be compared. Maintain gets skipped because nothing forces it, and an assessment that is eighteen months stale describes a system that no longer exists.

All fifteen tasks in NIST SP 800-30

The four steps are the headline; the work is fifteen numbered tasks. Listing them out is the fastest way to see what a thin assessment has left out — most registers can only evidence tasks 2-3 to 2-6.

Step	Task	What it requires
Prepare	1-1	Identify the purpose — what decision the assessment is meant to inform
Prepare	1-2	Identify the scope: organisational applicability, time frame, architectural and technology considerations
Prepare	1-3	Identify the assumptions and constraints you are working under, explicitly
Prepare	1-4	Identify the sources of descriptive, threat, vulnerability and impact information
Prepare	1-5	Identify the risk model and the analytic approach
Conduct	2-1	Identify and characterise threat sources, including capability, intent and targeting for adversarial ones
Conduct	2-2	Identify threat events, their relevance, and which sources could initiate them
Conduct	2-3	Identify vulnerabilities and predisposing conditions
Conduct	2-4	Determine likelihood that events of concern result in adverse impacts
Conduct	2-5	Determine the adverse impacts
Conduct	2-6	Determine the risk, combining impact and likelihood
Communicate	3-1	Communicate results to decision makers to support risk responses
Communicate	3-2	Share risk-related information with the personnel who need it
Maintain	4-1	Monitor the risk factors that drive changes in risk, on an ongoing basis
Maintain	4-2	Update the assessment using what the monitoring found

Tasks 1-1 through 1-5 are the ones to insist on. They are cheap, they take a morning, and they are the difference between an assessment and an opinion.

Threat sources, threat events and predisposing conditions

NIST SP 800-30 separates concepts that most risk registers merge, and the separation is the analytical value.

A threat source is who or what initiates — an adversary with capability and intent, but also human error, a structural failure or a natural event. A threat event is what happens. A vulnerability is the weakness exploited. A predisposing condition is a property of the organisation that makes an event more likely to have an adverse effect, regardless of any specific weakness.

Keeping those apart lets you see that one predisposing condition — a flat network, a single supplier, an unclear ownership model — sits underneath a dozen apparently unrelated risks. Merging them into a single “risk” line loses that entirely.

The publication also gives a four-way taxonomy of threat sources, and only the first of the four takes capability and intent as inputs:

Threat source type	Covers	Risk factors assessed
Adversarial	Individuals, groups, organisations or states seeking to exploit a dependence on information systems	Capability, intent, targeting
Accidental	Erroneous actions taken by people in the course of their duties	Range of effects
Structural	Failures of equipment, environmental controls or software	Range of effects
Environmental	Natural disasters and failures of critical infrastructure the organisation depends on	Range of effects

Registers that only hold adversarial sources are the common failure. Structural and environmental sources need no attacker, no intent and no sophistication, and they cause more outages than adversaries do.

How NIST SP 800-30 scores likelihood and impact

This is the part teams build from scratch without realising the publication already supplies it. NIST SP 800-30 offers three assessment approaches — qualitative, semi-quantitative and quantitative — and its appendices give three scales for every assessable risk factor: one qualitative and two semi-quantitative.

The semi-quantitative option uses bins or scales whose values carry no absolute meaning but do support consistent comparison — the publication’s own examples are bins of 0–15, 16–35, 36–70, 71–85 and 86–100, or a scale of 1–10. The combination of a five-point word scale, a 0–100 range and a 1–10 value is what lets a non-adversarial likelihood be anchored to an actual frequency:

Qualitative	0–100	1–10	Non-adversarial frequency anchor
Very High	96–100	10	Almost certain to occur, or occurs more than 100 times a year
High	80–95	8	Highly likely, or occurs between 10 and 100 times a year
Moderate	21–79	5	Somewhat likely, or occurs between 1 and 10 times a year
Low	5–20	2	Unlikely — less than once a year, more than once every 10 years
Very Low	0–4	0	Highly unlikely — less than once every 10 years

Those frequency anchors are the most useful lines in the document for anyone arguing with a stakeholder. “Moderate” stops being a feeling and becomes a claim that the event happens between once and ten times a year, which someone can check.

The risk determination table is worth reading closely too, because it is not symmetrical and it is not a multiplication:

Likelihood ↓ / Impact →	Very Low	Low	Moderate	High	Very High
Very High	Very Low	Low	Moderate	High	Very High
High	Very Low	Low	Moderate	High	Very High
Moderate	Very Low	Low	Moderate	Moderate	High
Low	Very Low	Low	Low	Low	Moderate
Very Low	Very Low	Very Low	Very Low	Low	Low

Two things fall out of the NIST SP 800-30 risk table. The Very High and High likelihood rows are identical, so moving a risk from “highly likely” to “almost certain” changes the risk level not at all — arguing about that distinction in a workshop is wasted time. And impact dominates: no amount of likelihood lifts a Very Low impact above Very Low risk. If your 5×5 matrix multiplies two scores and ranks the product, it does not behave like this one, and your Very Low impact items are outranking things that matter.

Choosing a NIST SP 800-30 analysis approach

Separately from the scoring, NIST SP 800-30 offers three analysis approaches, which differ in where the assessment starts:

• Threat-oriented — start from threat sources and events, build threat scenarios, then identify vulnerabilities in the context of those threats.
• Asset / impact-oriented — start from the impacts and critical assets you care about, often using a business impact analysis, then work back to the events that could cause them.
• Vulnerability-oriented — start from predisposing conditions and known weaknesses, then identify what could exercise them and what would follow.

All three consider the same risk factors in a different order. The warning attached to them is the important part: the starting point can bias the results so that some risks are never identified at all. The publication’s own remedy is to run a second orientation over the same scope — commonly an asset/impact pass over a threat-oriented assessment — to improve the rigour of the analysis.

In practice that is the cheapest quality step available on an existing assessment. If yours was built vulnerability-first out of a scanner, a short asset/impact pass will surface the risks the scanner could never see.

What the NIST SP 800-30 appendices give you

Most of the publication is appendices, and most readers stop at chapter 3. The appendices are the reusable part — the catalogues and scales that mean you never start a NIST SP 800-30 assessment from a blank page.

Appendix	Contents	Use it for
A–C	References, glossary, acronyms	Settling terminology arguments in writing
D	Threat sources, with the taxonomy and adversary capability, intent and targeting scales	Populating the threat source list and characterising adversaries
E	Threat events, adversarial and non-adversarial	A starting catalogue so workshops are not pure brainstorming
F	Vulnerabilities and predisposing conditions, with severity and pervasiveness scales	Rating weaknesses consistently across systems
G	Likelihood of occurrence, split into initiation (adversarial) and occurrence (non-adversarial)	The frequency-anchored likelihood scales above
H	Impact, with types of impact and the assessment scale	Defining impact so two assessors land on the same number
I	Risk determination, including the combination table	Turning likelihood and impact into a level of risk
J	Informing risk response	Making results actually usable by the people deciding treatment

Appendix G alone will fix most registers. Appendix J is the one nobody reads and the one that determines whether the assessment changes a decision.

How NIST SP 800-30 relates to other frameworks

Framework	Relationship
NIST CSF	CSF tells you which outcomes to pursue; SP 800-30 tells you how to work out which ones matter most here. They are commonly run together
SP 800-37 (RMF)	The seven-step lifecycle that calls for the assessment. SP 800-30 is the method that satisfies the risk assessment expectation inside it
SP 800-53	The control catalog you select from once the assessment has told you what you are treating
ISO 31000	The international general risk management standard. ISO 31000 is broader and sector-neutral; SP 800-30 is deeper and specific to information security risk. If you run both, use ISO 31000 for criteria and governance and 800-30 for the assessment method
ISO/IEC 27005	The closest ISO-family counterpart. The fourth edition, ISO/IEC 27005:2022, published in October 2022, covers the same ground for an ISO 27001 ISMS
ISO 27001	Clause 6.1.2 requires a risk assessment process without mandating one. SP 800-30 is a defensible answer, particularly for organisations with a US federal footprint

NIST SP 800-30 FAQ

Is NIST SP 800-30 mandatory?

No. It is guidance, not a requirement. What creates the obligation is the framework around it — the Risk Management Framework in SP 800-37 Rev. 2 expects a risk assessment, and NIST SP 800-30 is the method NIST points to for performing one. Outside federal systems nothing compels its use at all.

Has NIST SP 800-30 been replaced or withdrawn?

No. Revision 1 remains the current revision, with no Revision 2 and no public draft of one as at 2 November 2026. The 2012 date on the cover is not a status.

Can you get certified against NIST SP 800-30?

No. There is no certification scheme for it, in the same way there is none for the NIST Cybersecurity Framework. You can be assessed against a framework that requires a risk assessment — ISO 27001, for instance — and use SP 800-30 as the method you have adopted.

What is the difference between SP 800-30 and SP 800-39?

SP 800-39 is the organisation-wide risk management programme: governance, risk framing, risk response and monitoring across all three tiers. SP 800-30 is the assessment component inside it, and says so explicitly — it was written to amplify SP 800-39.

Which analysis approach should a first NIST SP 800-30 assessment use?

Asset/impact-oriented, in most cases. It starts from what the organisation would mind losing, which is the only starting point that produces a Tier 1 conversation. Add a threat-oriented pass afterwards to catch what an impact lens misses.

Where to start with NIST SP 800-30

1. Write the Prepare step down. Purpose, scope, assumptions, constraints, risk model, analytic approach — tasks 1-1 to 1-5. One page, before any analysis.
2. Assess at Tier 2 at least once. If you have only ever done Tier 3, this is where the surprises are.
3. Adopt the Appendix G likelihood scale verbatim, frequency anchors included, so “Moderate” becomes a checkable claim.
4. Separate threat sources from events, vulnerabilities and predisposing conditions in the register structure, not just in the narrative.
5. Add the non-adversarial sources — accidental, structural and environmental — if your register only holds attackers.
6. Run a second analysis orientation over the same scope to find what your starting point hid.
7. Write the output for the reader — senior leaders determining courses of action, per the standard’s own framing — and carry it through to a documented risk response.
8. Set a maintenance trigger, not just an annual date, so material change forces a refresh.
9. Read SP 800-39 alongside it, because 800-30 was written to amplify it.

If you want the four-step walkthrough on its own, the NIST SP 800-30 risk assessment steps are covered separately in more operational detail.

This guide reflects csrc.nist.gov at 2 November 2026, on which SP 800-30 Rev. 1 remains the current revision and no Revision 2 is listed.

The NIST Cyber Risk Management Toolkit provides 50+ editable files covering the risk assessment methodology, the threat and vulnerability catalogues, the risk register and treatment records, and the reporting artefacts that carry results to the people who decide.