Security risk assessment
A security risk assessment identifies and analyzes threats, vulnerabilities, likelihood, and potential impact within a defined scope to help an organization decide how to manage risk.
Start with the decision you need to make
A team deciding how to protect a payment process needs to understand more than which software has vulnerabilities. It needs to consider relevant threats, how a harmful event could occur, existing safeguards, and the consequences for the business.
NIST SP 800-30 describes preparing and conducting an assessment, communicating its results, and keeping it current. The assessment records its scope, assumptions, information sources, and analysis approach. NIST SP 800-39 places assessment within wider risk management: the organization still has to decide how to respond and monitor what changes.
A finding is input, not the whole assessment
A vulnerability scan may identify a weakness. A penetration test may demonstrate that it can be exploited. A social engineering exercise may show a verification step being skipped. Each can inform the assessment, but none automatically establishes the likelihood and business impact of every related incident.
Keep the uncertainty with the conclusion. A rating such as “high” needs an explanation of the method and assumptions behind it. It is not a precise probability simply because it appears in a matrix.
The help-desk assessment article shows how to define what a particular exercise actually measures. The targeting article helps connect threat information with local priorities.
Update the assessment when important conditions change, such as access, business dependencies, threat activity, or the controls in place. Record what changed and whether it alters the earlier decision.