NIST SP 800-30 NISTSP30-1: Risk Management Strategy and Risk Assessment Programme Establishment

Establish an organisation-wide risk management strategy per NIST SP 800-30 Rev 1 Chapter 2 (Fundamentals) and Chapter 3 (The Process) that (a) defines the purpose, scope, assumptions, constraints, risk tolerance, and priorities for risk assessment, (b) integrates risk assessment with the broader NIST SP 800-39 (Managing Information Security Risk) and NIST RMF (SP 800-37) processes, (c) establishes the risk assessment programme that determines frequency of assessments, triggers for ad-hoc assessments (significant change, incident, new threat intelligence), and management review cadence, (d) defines the three-tier hierarchy (Tier 1 organisation, Tier 2 mission/business process, Tier 3 information system) the organisation will use to scope assessments, (e) names the senior accountable officer (typically Risk Executive Function), the assessment owner per tier, and the maintenance owner. Capture the strategy in an approved risk management policy.