NIST SP 800-30 Rev 1

United States

4 domains

39 controls

NIST SP 800-30 Revision 1 Guide for Conducting Risk Assessments.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

Communicate-Share

4 controls

Controls in the Communicate-Share domain of NIST SP 800-30 Rev 1 — 4 controls
Code	Title	Description
RA-COMM-1	Communicate Risk Assessment Results	Communicate the results of the risk assessment to organizational decision makers in a form and at a frequency appropriat...
RA-COMM-2	Share Risk Information	Share risk-related information across the organization, including threat, vulnerability, impact, and risk findings, with...
RA-COMM-3	Tier-Aware Reporting	Tailor communication and sharing to Tier 1 (governance), Tier 2 (mission and business process), and Tier 3 (information...
RA-OUTPUT-1	Assessment Outputs Drive Risk Response	Ensure assessment outputs are structured to support the risk response step of the risk management process, including rec...

Conduct

17 controls

Controls in the Conduct domain of NIST SP 800-30 Rev 1 — 17 controls
Code	Title	Description
RA-CONDUCT-1	Identify Threat Sources	Identify and characterize threat sources of concern including adversarial (capability, intent, targeting), accidental, s...
RA-CONDUCT-2	Identify Threat Events	Identify potential threat events, relevance to the organization, and the threat sources that could initiate each event,...
RA-CONDUCT-3	Identify Vulnerabilities and Predisposing Conditions	Identify vulnerabilities and predisposing conditions (information-related, technical, environmental, operational, organi...
RA-CONDUCT-4	Determine Likelihood of Occurrence	Determine the likelihood that threat events will be initiated (for adversarial) or occur (for non-adversarial) and the l...
RA-CONDUCT-5	Determine Magnitude of Impact	Determine the adverse impacts from threat events including effects on operations, assets, individuals, other organizatio...
RA-CONDUCT-6	Determine Risk	Determine risk as a function of likelihood and impact for each threat event, considering uncertainty, and assign risk le...
RA-CONDUCT-7	Aggregate Risk Across Assets and Missions	Where appropriate, aggregate risks across multiple threat events, assets, or organizational tiers to support enterprise-...
RA-CONDUCT-8	Document Risk Assessment Results	Document risk assessment results in the form required to support intended decisions, including assumptions, scope, metho...
RA-MODEL-2	Adversary Capability, Intent, and Targeting	Characterize adversarial threat sources by capability (resources and skill), intent (motivation to act), and targeting (...
RA-MODEL-3	Threat Event Catalog	Maintain a catalog of representative threat events for adversarial and non-adversarial scenarios drawn from Appendix E a...
RA-MODEL-4	Vulnerability Severity and Pervasiveness	Rate identified vulnerabilities by severity (potential adverse impact if exploited) and pervasiveness (extent of presenc...
RA-MODEL-5	Predisposing Conditions	Identify predisposing conditions, including information-related, technical, and environmental conditions that increase o...
RA-MODEL-6	Likelihood Scales	Use defined likelihood scales for likelihood of initiation/occurrence, likelihood of impact, and overall likelihood, wit...
RA-MODEL-7	Impact Types and Scales	Define impact types (harm to operations, assets, individuals, other organizations, the Nation) and associated rating sca...
RA-MODEL-8	Risk Level Determination	Combine likelihood and impact to produce a risk level using a defined matrix or formula, with rating definitions for ver...
RA-MODEL-9	Uncertainty Handling	Capture and convey uncertainty inherent in risk assessment results, including data quality, assumptions, and limits of a...
RA-QA-1	Assessment Quality Assurance	Apply quality assurance to the assessment, including peer review of methodology, inputs, analysis, and findings, to supp...

Maintain

4 controls

Controls in the Maintain domain of NIST SP 800-30 Rev 1 — 4 controls
Code	Title	Description
RA-MAINT-1	Monitor Risk Factors	Monitor risk factors identified in the assessment on an ongoing basis to detect changes in threat sources, threat events...
RA-MAINT-2	Update Risk Assessment	Update existing risk assessments using results of ongoing monitoring and following significant changes in the system, en...
RA-MAINT-3	Integrate With Continuous Monitoring	Integrate risk assessment maintenance with the organizational information security continuous monitoring program so that...
RA-MAINT-4	Trigger-Based Reassessment	Define and execute triggers for reassessment such as major system changes, new threats, incidents, regulatory changes, o...

Prepare

14 controls

Controls in the Prepare domain of NIST SP 800-30 Rev 1 — 14 controls
Code	Title	Description
RA-GOV-1	Risk Assessment Methodology Documentation	Document the organizational risk assessment methodology including risk model, analytic approach, assessment approach, an...
RA-GOV-2	Three-Tier Risk Management Alignment	Align risk assessments with the three-tier organizational risk management approach (organization, mission/business proce...
RA-GOV-3	Risk Tolerance and Acceptance	Establish and document organizational risk tolerance and acceptance criteria that inform how risk levels translate into...
RA-GOV-4	Reuse of Prior Assessment Results	When reusing prior assessment results, evaluate currency, applicability, methodology compatibility, and confidence to en...
RA-INPUT-1	Tier 1 Inputs to Assessment	Incorporate Tier 1 inputs such as organizational risk strategy, risk tolerance, mission and business priorities, and arc...
RA-INPUT-2	Tier 2 and Tier 3 Inputs	Incorporate Tier 2 mission and business process inputs (e.g., information protection needs, dependencies) and Tier 3 sys...
RA-MODEL-1	Threat Source Taxonomy	Adopt and tailor a taxonomy of threat sources covering adversarial (individual, group, organization, nation-state), acci...
RA-PREP-1	Identify Purpose of Risk Assessment	Establish and document the explicit purpose of the risk assessment, including the decisions it will inform (e.g., author...
RA-PREP-2	Identify Scope of Risk Assessment	Define organizational applicability, time frame, architectural and technology boundaries, and the operational, functiona...
RA-PREP-3	Identify Assumptions and Constraints	Document assumptions and constraints regarding threat sources, threat events, vulnerabilities, predisposing conditions,...
RA-PREP-4	Identify Sources of Information	Identify and document the sources of descriptive and threat-related information (internal and external) to be used as in...
RA-PREP-5	Identify Risk Model	Select and document the risk model (factors and relationships) used, including threat source, threat event, vulnerabilit...
RA-PREP-6	Identify Analytic Approach	Select the assessment approach (quantitative, qualitative, semi-quantitative) and the analysis approach (threat-oriented...
RA-PREP-7	Establish Assessment Team and Roles	Identify the assessment team, including roles, responsibilities, required expertise, independence, and coordination with...

Frequently Asked Questions

What is NIST SP 800-30 Rev 1?

NIST SP 800-30 Rev 1 is a compliance framework from United States with 4 domains and 39 controls. NIST SP 800-30 Revision 1 Guide for Conducting Risk Assessments. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does NIST SP 800-30 Rev 1 have?

NIST SP 800-30 Rev 1 has 39 controls organised across 4 domains. The largest domains are Conduct (17 controls), Prepare (14 controls), Communicate-Share (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does NIST SP 800-30 Rev 1 map to?

NIST SP 800-30 Rev 1 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with NIST SP 800-30 Rev 1 compliance?

Start your NIST SP 800-30 Rev 1 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-30 Rev 1 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 39 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required