# Risk Assessment Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ra/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Risk Assessment, and who is accountable for meeting those requirements. (RA-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (RA-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (RA-1a.1(a))
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (RA-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (RA-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (RA-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (RA-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (RA-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (RA-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (RA-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (RA-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (RA-1a.1(a))

## Procedures

The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (RA-1a.2)

## Dissemination

- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the risk assessment policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (RA-1a)
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the risk assessment procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (RA-1a)

## Policy statements

### Security categorization (RA-2)

- Each [System owner] shall categorize the system and the information it processes, stores and transmits. (RA-2a)
- The [System owner] shall document the categorization results, with the supporting rationale, in the system security plan. (RA-2b)
- The [System owner] shall have the authorizing official, or a designated representative, review and approve the categorization decision. (RA-2c)
- The [System owner] shall review the categorization whenever the system, the information it handles or its environment of operation changes significantly. (RA-2a)

#### Federal systems

Federal systems categorize information and systems under [FIPS 199](https://csrc.nist.gov/pubs/fips/199/final), Standards for Security Categorization of Federal Information and Information Systems (February 2004), and identify information types from [NIST SP 800-60 Rev. 1](https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final) (August 2008; Volume 2 lists the types). A [Rev. 2 initial working draft](https://csrc.nist.gov/pubs/sp/800/60/r2/iwd) (January 2024) is not final, as of September 2026.

- The [System owner] shall identify the system's information types using NIST SP 800-60. (RA-2a)
- The [System owner] shall categorize the system under FIPS 199, using the highest impact level of its information types for each security objective. (RA-2a)

### Risk assessment (RA-3)

- Each [System owner] shall conduct a risk assessment of the system that identifies threats to and vulnerabilities in the system. (RA-3a.1)
- The risk assessment shall determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification or destruction of the system, the information it processes, stores or transmits, and any related information. (RA-3a.2)
- For a system that processes personally identifiable information, the risk assessment shall determine the likelihood and impact of adverse effects on individuals arising from that processing. (RA-3a.3)
- The [System owner] shall integrate the organization's risk management strategy, risk framing and mission or business process risk decisions into the system risk assessment. (RA-3b)
- The [System owner] shall document the risk assessment results in the [Select one: security and privacy plans; risk assessment report; [Assignment: organization-defined document]. Typical: risk assessment report]. (RA-3c)
- The [System owner] shall review the risk assessment results [Fill in: the frequency to review risk assessment results. Typical: annually]. (RA-3d)
- The [System owner] shall share the risk assessment results with [Fill in: personnel or roles to whom risk assessment results are to be disseminated. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (RA-3e)
- The [System owner] shall update the risk assessment [Fill in: the frequency to update the risk assessment. Typical: at least every three years], and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

### Supply chain risk assessment (RA-3(1))

- The [System owner] shall assess the supply chain risks associated with [Fill in: systems, system components, and system services to assess supply chain risks. Typical: each system, the components and services the criticality analysis (RA-9) identifies as critical, and the external services the system depends on]. (RA-3(1)(a))
- The [System owner] shall update the supply chain risk assessment [Fill in: the frequency at which to update the supply chain risk assessment. Typical: annually], when there are significant changes to the relevant supply chain, and when changes to the system, its environment of operation or other conditions call for it. (RA-3(1)(b))

### Vulnerability monitoring and scanning (RA-5)

- Each [System owner] shall ensure the system and its hosted applications are monitored for vulnerabilities [Fill in: frequency for monitoring systems and hosted applications for vulnerabilities. Typical: continuously, through vendor advisories, vulnerability feeds and the CISA Known Exploited Vulnerabilities Catalog]. (RA-5a)
- The [System owner] shall ensure the system and its hosted applications are scanned for vulnerabilities [Fill in: frequency for scanning systems and hosted applications for vulnerabilities. Typical: at least monthly for infrastructure, and before each major release for applications], and when new vulnerabilities potentially affecting the system are identified and reported. (RA-5a)
- The [Chief Information Security Officer] shall provide vulnerability monitoring tools that use standards for enumerating platforms, software flaws and improper configurations, for formatting checklists and test procedures, and for measuring vulnerability impact. (RA-5b)
- The [Chief Information Security Officer] shall provide vulnerability monitoring tools that can readily update the vulnerabilities to be scanned. (RA-5f)
- The [System owner] shall analyze vulnerability scan reports and the results of vulnerability monitoring, and record any finding judged a false positive with the reason. (RA-5c)
- The [System owner] shall remediate legitimate vulnerabilities within [Fill in: response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk. Typical: known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days], in accordance with an organizational assessment of risk. (RA-5d)
- The [System owner] shall share information obtained from vulnerability monitoring and control assessments with [Fill in: personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared. Typical: the owners of similar systems and the security operations team], to help eliminate similar vulnerabilities in other systems. (RA-5e)

#### Federal systems

CISA binding operational directives set minimums for federal civilian agencies (as of September 2026). [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk), Prioritizing Security Updates Based on Risk (June 10, 2026), sets remediation deadlines by exposure, KEV status, whether exploitation can be automated, and technical impact; its clock starts when CISA adds a vulnerability to the KEV catalog or the agency identifies it, whichever is first. [BOD 23-01](https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks), Improving Asset Visibility and Vulnerability Detection on Federal Networks (October 3, 2022), requires automated asset discovery every 7 days and vulnerability enumeration across discovered assets every 14 days.

- The [System owner] shall remediate vulnerabilities no later than the deadlines CISA BOD 26-04 sets. (RA-5d)
- The [System owner] shall ensure the system's assets are covered by automated asset discovery at least every 7 days and by vulnerability enumeration at least every 14 days, as CISA BOD 23-01 requires. (RA-5a)

### Update vulnerabilities to be scanned (RA-5(2))

- The [System owner] shall ensure the vulnerabilities the scanning tools check for are updated [Select one or more: [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported. Typical: prior to a new scan]. (RA-5(2))

### Privileged access (RA-5(5))

- The [System owner] shall authorize privileged access to [Fill in: system components to which privileged access is authorized for selected vulnerability scanning activities. Typical: operating systems, databases and web applications] for [Fill in: vulnerability scanning activities selected for privileged access authorization to system components. Typical: credentialed (authenticated) vulnerability scans]. (RA-5(5))

### Public disclosure program (RA-5(11))

- The [Chief Information Security Officer] shall establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components. (RA-5(11))
- The [Chief Information Security Officer] shall publish how to use the reporting channel and which systems it covers. (RA-5(11))
- The [Security operations team] shall acknowledge, analyze and track each report received through the channel. (RA-5(11))

#### Federal systems

[CISA BOD 20-01](https://www.cisa.gov/news-events/directives/bod-20-01-develop-and-publish-vulnerability-disclosure-policy), Develop and Publish a Vulnerability Disclosure Policy (September 2, 2020), requires federal civilian agencies to publish a vulnerability disclosure policy (in effect as of September 2026).

- The [Chief Information Security Officer] shall publish and maintain a vulnerability disclosure policy that meets CISA BOD 20-01. (RA-5(11))

### Risk response (RA-7)

- Each [System owner] shall respond to findings from security and privacy assessments, monitoring and audits in accordance with the organizational risk tolerance set in the risk management strategy. (RA-7)
- The [System owner] shall record each response as a remediation, a plan of action and milestones item, or a risk acceptance. (RA-7)
- A risk to an authorized system shall be accepted only by its authorizing official, after consulting the roles the risk management strategy names for that risk level. (RA-7)

### Criticality analysis (RA-9)

- The [System owner] shall identify critical system components and functions by performing a criticality analysis for [Fill in: systems, system components, or system services to be analyzed for criticality. Typical: each Moderate and High system, and the components and services that support its critical functions] at [Fill in: decision points in the system development life cycle when a criticality analysis is to be performed. Typical: during design, before acquiring major components or services, and when the architecture changes significantly]. (RA-9)

## Review and update

- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current risk assessment policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current risk assessment policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (RA-1c.1)
- The [Fill in: an official to manage the risk assessment policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current risk assessment procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require risk assessment procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (RA-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (RA-1a.1(b))