# Risk Assessment Report

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/reports/risk-assessment-report/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| System name | System identifier | Report version | Assessment date | Prepared by |
| --- | --- | --- | --- | --- |
| [Fill in: system name] | [Fill in: unique system identifier] | [Fill in: version] | [Fill in: date] | [Fill in: names and titles of the assessment team] |

## 1. Executive summary

- **System and purpose of the assessment:** [Fill in: the system, its security categorization, and why this assessment was done, for example initial authorization, a significant change or the scheduled update]
- **Overall result:** [Fill in: the number of risks at each level, and the most significant risks in one or two sentences each]
- **Recommended actions:** [Fill in: the main risk responses recommended, and any risk above the organization's tolerance]

## 2. Purpose and scope

| Item | Description |
| --- | --- |
| Purpose | [Fill in: the decision this assessment supports] |
| Scope | [Fill in: the system boundary, components, locations and external services covered, and anything excluded] |
| Time frame | [Fill in: the period for which the results are expected to be valid] |
| Security categorization | [Fill in: low, moderate or high, from the security categorization worksheet] |
| Privacy | [Fill in: whether the system processes personally identifiable information; if so, the privacy impact assessment it draws on] |

## 3. Assumptions, constraints and risk tolerance

- **Assumptions:** [Fill in: for example that inherited common controls operate as their providers describe]
- **Constraints:** [Fill in: for example time, access or information not available to the assessors]
- **Risk tolerance:** the tolerance and approval levels in section 3.3 of the organization's risk management strategy apply, together with [Fill in: any system-specific tolerance statements, or "none"].
- **Organization and mission inputs:** [Fill in: the organization-level and mission or business process risk decisions this assessment builds on (RA-3b), for example the risk framing and the organization's threat information].

## 4. Risk model and approach

| Item | Approach |
| --- | --- |
| Risk model | [Fill in: for example SP 800-30 Rev. 1: threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact] |
| Assessment approach | [Fill in: qualitative, semi-quantitative or quantitative] |
| Analysis approach | [Fill in: threat-oriented, asset or impact-oriented, or vulnerability-oriented] |
| Scales | [Fill in: the likelihood, impact and risk scales from the risk management strategy] |
| Information sources | [Fill in: for example control assessment results, vulnerability scans, penetration tests, threat intelligence, incident history, interviews] |

## 5. Results

The assessment identified threats to and vulnerabilities in the system (RA-3a.1), and determined the likelihood and magnitude of harm to the organization, its information and related information (RA-3a.2) and, where the system processes personally identifiable information, the likelihood and impact of adverse effects on individuals (RA-3a.3).

| ID | Threat source and event | Vulnerability or predisposing condition | Likelihood | Impact | Risk level | Recommended response |
| --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID from the risk register] | [Fill in: threat source and event] | [Fill in: vulnerability or condition] | [Fill in: level] | [Fill in: level] | [Fill in: level] | [Fill in: accept, avoid, mitigate, share or transfer, with the action] |
| [Fill in: ID] | [Fill in: threat source and event] | [Fill in: vulnerability or condition] | [Fill in: level] | [Fill in: level] | [Fill in: level] | [Fill in: response] |

### 5.1 Risks to individuals

[Fill in: the privacy risks found, with likelihood, impact and recommended response, or "the system does not process personally identifiable information"] (RA-3a.3)

### 5.2 Supply chain risks

Supply chain risks were assessed for [Fill in: systems, system components, and system services to assess supply chain risks. Typical: each system, the components and services the criticality analysis (RA-9) identifies as critical, and the external services the system depends on] (RA-3(1)(a)). [Fill in: the suppliers, products and services considered, the risks found and the recommended responses]

## 6. Documentation, review and distribution

- The [System owner] shall keep this report as the record of the risk assessment results. (RA-3c)
- The [System owner] shall review the results [Fill in: the frequency to review risk assessment results. Typical: annually]. (RA-3d)
- The [System owner] shall share the results with [Fill in: personnel or roles to whom risk assessment results are to be disseminated. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (RA-3e)
- The [System owner] shall update the assessment [Fill in: the frequency to update the risk assessment. Typical: at least every three years], and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

| Version | Date | Reviewed or updated by | Summary of change | Shared with |
| --- | --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: name and title] | [Fill in: summary] | [Fill in: recipients] |

## Appendix A. Assessment team and sources

[Fill in: the assessment team members and their roles, and the documents, tools and people consulted]

## Appendix B. Supporting data

[Fill in: the detailed threat, vulnerability, likelihood and impact analysis behind section 5, or a reference to where it is kept]