# Risk Assessment Report

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/reports/risk-assessment-report/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** This outline follows Appendix K, Risk Assessment Reports, of [NIST SP 800-30 Rev. 1](https://csrc.nist.gov/pubs/sp/800/30/r1/final) (September 2012, current as of September 2026): an executive summary, a main body with the detailed results, and supporting appendices. Use the methodology and scales in the organization's risk management strategy, so this system's risks can be compared with others. Each risk found here goes into the [risk register](https://kston83.github.io/nist-guide/templates/forms/risk-register/), and each one that needs action goes into the plan of action and milestones. The report describes the system's weaknesses, so restrict access to it.

| System name | System identifier | Report version | Assessment date | Prepared by |
| --- | --- | --- | --- | --- |
| [Fill in: system name] | [Fill in: unique system identifier] | [Fill in: version] | [Fill in: date] | [Fill in: names and titles of the assessment team] |

## 1. Executive summary

- **System and purpose of the assessment:** [Fill in: the system, its security categorization, and why this assessment was done, for example initial authorization, a significant change or the scheduled update]
- **Overall result:** [Fill in: the number of risks at each level, and the most significant risks in one or two sentences each]
- **Recommended actions:** [Fill in: the main risk responses recommended, and any risk above the organization's tolerance]

## 2. Purpose and scope

| Item | Description |
| --- | --- |
| Purpose | [Fill in: the decision this assessment supports] |
| Scope | [Fill in: the system boundary, components, locations and external services covered, and anything excluded] |
| Time frame | [Fill in: the period for which the results are expected to be valid] |
| Security categorization | [Fill in: low, moderate or high, from the security categorization worksheet] |
| Privacy | [Fill in: whether the system processes personally identifiable information; if so, the privacy impact assessment it draws on] |

## 3. Assumptions, constraints and risk tolerance

- **Assumptions:** [Fill in: for example that inherited common controls operate as their providers describe]
- **Constraints:** [Fill in: for example time, access or information not available to the assessors]
- **Risk tolerance:** the tolerance and approval levels in section 3.3 of the organization's risk management strategy apply, together with [Fill in: any system-specific tolerance statements, or "none"].
- **Organization and mission inputs:** [Fill in: the organization-level and mission or business process risk decisions this assessment builds on (RA-3b), for example the risk framing and the organization's threat information].

## 4. Risk model and approach

| Item | Approach |
| --- | --- |
| Risk model | [Fill in: for example SP 800-30 Rev. 1: threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact] |
| Assessment approach | [Fill in: qualitative, semi-quantitative or quantitative] |
| Analysis approach | [Fill in: threat-oriented, asset or impact-oriented, or vulnerability-oriented] |
| Scales | [Fill in: the likelihood, impact and risk scales from the risk management strategy] |
| Information sources | [Fill in: for example control assessment results, vulnerability scans, penetration tests, threat intelligence, incident history, interviews] |

> **Guidance:** If the organization has not yet set its own scale, SP 800-30 Rev. 1 Appendix I, Table I-2, "Assessment Scale – Level of Risk (Combination of Likelihood and Impact)", combines five levels of likelihood and impact as shown below.
>
> | Likelihood | Very low impact | Low impact | Moderate impact | High impact | Very high impact |
> | --- | --- | --- | --- | --- | --- |
> | Very high | Very low | Low | Moderate | High | Very high |
> | High | Very low | Low | Moderate | High | Very high |
> | Moderate | Very low | Low | Moderate | Moderate | High |
> | Low | Very low | Low | Low | Low | Moderate |
> | Very low | Very low | Very low | Very low | Low | Low |

## 5. Results

The assessment identified threats to and vulnerabilities in the system (RA-3a.1), and determined the likelihood and magnitude of harm to the organization, its information and related information (RA-3a.2) and, where the system processes personally identifiable information, the likelihood and impact of adverse effects on individuals (RA-3a.3).

| ID | Threat source and event | Vulnerability or predisposing condition | Likelihood | Impact | Risk level | Recommended response |
| --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID from the risk register] | [Fill in: threat source and event] | [Fill in: vulnerability or condition] | [Fill in: level] | [Fill in: level] | [Fill in: level] | [Fill in: accept, avoid, mitigate, share or transfer, with the action] |
| [Fill in: ID] | [Fill in: threat source and event] | [Fill in: vulnerability or condition] | [Fill in: level] | [Fill in: level] | [Fill in: level] | [Fill in: response] |

### 5.1 Risks to individuals

[Fill in: the privacy risks found, with likelihood, impact and recommended response, or "the system does not process personally identifiable information"] (RA-3a.3)

### 5.2 Supply chain risks

Supply chain risks were assessed for [Fill in: systems, system components, and system services to assess supply chain risks. Typical: each system, the components and services the criticality analysis (RA-9) identifies as critical, and the external services the system depends on] (RA-3(1)(a)). [Fill in: the suppliers, products and services considered, the risks found and the recommended responses]

## 6. Documentation, review and distribution

- The [System owner] shall keep this report as the record of the risk assessment results. (RA-3c)
- The [System owner] shall review the results [Fill in: the frequency to review risk assessment results. Typical: annually]. (RA-3d)
- The [System owner] shall share the results with [Fill in: personnel or roles to whom risk assessment results are to be disseminated. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (RA-3e)
- The [System owner] shall update the assessment [Fill in: the frequency to update the risk assessment. Typical: at least every three years], and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

| Version | Date | Reviewed or updated by | Summary of change | Shared with |
| --- | --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: name and title] | [Fill in: summary] | [Fill in: recipients] |

## Appendix A. Assessment team and sources

[Fill in: the assessment team members and their roles, and the documents, tools and people consulted]

## Appendix B. Supporting data

[Fill in: the detailed threat, vulnerability, likelihood and impact analysis behind section 5, or a reference to where it is kept]