Risk Assessment (RA)
The Risk Assessment family has 9 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| RA-1 | Policy and Procedures | Yes | Yes | Yes | Yes |
| RA-2 | Security Categorization | Yes | Yes | Yes | |
| RA-3 | Risk Assessment | Yes | Yes | Yes | Yes |
| RA-5 | Vulnerability Monitoring and Scanning | Yes | Yes | Yes | |
| RA-6 | Technical Surveillance Countermeasures Survey | ||||
| RA-7 | Risk Response | Yes | Yes | Yes | Yes |
| RA-8 | Privacy Impact Assessments | Yes | |||
| RA-9 | Criticality Analysis | Yes | Yes | ||
| RA-10 | Threat Hunting |
Withdrawn controls: RA-4.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.