Guide for Conducting Risk Assessments

Key concepts

The guide supplies a four-step process (prepare, conduct, communicate, maintain) and reference tables for threat sources, threat events, vulnerabilities, likelihood and impact. Assessments can cover the whole organization, a business process or a single system. The aim is decision support, not a score for its own sake.

• Risk is a function of threat, vulnerability, likelihood and impact
• Three levels: organization, mission or business process, information system
• Qualitative, semi-quantitative or quantitative scales

How it is organized

• Chapter 1: introduction
• Chapter 2: fundamentals (risk models and assessment approaches)
• Chapter 3: the process (prepare, conduct, communicate, maintain)
• Appendices D-I: threat sources, threat events, vulnerabilities, likelihood, impact, risk determination
• Appendices J-L: informing risk response, sample report outline, task summary

What a school district should take from it

• A simple five-level likelihood and impact scale is enough for district decisions.
• Assess the systems that would stop school, such as the student information system, finance and phones, first.
• Write down assumptions so next year's assessment is comparable.

How to use it in your district

1. Pick three critical systems and assess them with the chapter 3 steps in a two-hour working session.
2. Use the likelihood and impact scales from the appendices instead of inventing your own.
3. Record each significant risk in the Risk register or Improvement plan with an owner.
4. Repeat after major changes such as a new student information system or a merger of networks.

Common misconceptions

A vulnerability scan is a risk assessment.

A scan finds weaknesses. A risk assessment also weighs threats, likelihood and impact on the district's mission.

This 2012 guide is obsolete.

It remains NIST's current final risk assessment guide; no newer revision or draft exists.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• ID.RARisk Assessment
• GV.RMRisk Management Strategy

Tools in the program portal

• Risk registerRecord gaps leadership formally accepts, with controls and review dates
• Improvement planGive each gap an owner, a date and a first step
• Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why
• Vulnerability alertsKnown exploited vulnerabilities that match your systems

Related publications

• SP 800-39Managing information security risk
• IR 8286 Rev. 1Cyber risk and enterprise risk management
• SP 800-37 Rev. 2Risk Management Framework (RMF)