Risk Assessment Report

Risk Assessment Report template: The report of a system risk assessment, following the three-part outline in NIST SP 800-30 Rev. 1 Appendix K, with the documentation, review and distribution SP 800-53 RA-3 requires.

Type	Program stage	Status	Template version	NIST basis
Report	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The report of a system risk assessment, following the three-part outline in NIST SP 800-30 Rev. 1 Appendix K, with the documentation, review and distribution SP 800-53 RA-3 requires.

Controls satisfied

Control	Title
RA-3	Risk Assessment
RA-3(1)	Supply Chain Risk Assessment

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

This outline follows Appendix K, Risk Assessment Reports, of NIST SP 800-30 Rev. 1 (September 2012, current as of September 2026): an executive summary, a main body with the detailed results, and supporting appendices. Use the methodology and scales in the organization’s risk management strategy, so this system’s risks can be compared with others. Each risk found here goes into the risk register, and each one that needs action goes into the plan of action and milestones. The report describes the system’s weaknesses, so restrict access to it.

System name	System identifier	Report version	Assessment date	Prepared by
Fill in: system name	Fill in: unique system identifier	Fill in: version	Fill in: date	Fill in: names and titles of the assessment team

1. Executive summary

• System and purpose of the assessment: Fill in: the system, its security categorization, and why this assessment was done, for example initial authorization, a significant change or the scheduled update
• Overall result: Fill in: the number of risks at each level, and the most significant risks in one or two sentences each
• Recommended actions: Fill in: the main risk responses recommended, and any risk above the organization’s tolerance

2. Purpose and scope

Item	Description
Purpose	Fill in: the decision this assessment supports
Scope	Fill in: the system boundary, components, locations and external services covered, and anything excluded
Time frame	Fill in: the period for which the results are expected to be valid
Security categorization	Fill in: low, moderate or high, from the security categorization worksheet
Privacy	Fill in: whether the system processes personally identifiable information; if so, the privacy impact assessment it draws on

3. Assumptions, constraints and risk tolerance

• Assumptions: Fill in: for example that inherited common controls operate as their providers describe
• Constraints: Fill in: for example time, access or information not available to the assessors
• Risk tolerance: the tolerance and approval levels in section 3.3 of the organization’s risk management strategy apply, together with Fill in: any system-specific tolerance statements, or “none”.
• Organization and mission inputs: Fill in: the organization-level and mission or business process risk decisions this assessment builds on (RA-3b), for example the risk framing and the organization’s threat information.

4. Risk model and approach

Item	Approach
Risk model	Fill in: for example SP 800-30 Rev. 1: threat sources, threat events, vulnerabilities and predisposing conditions, likelihood and impact
Assessment approach	Fill in: qualitative, semi-quantitative or quantitative
Analysis approach	Fill in: threat-oriented, asset or impact-oriented, or vulnerability-oriented
Scales	Fill in: the likelihood, impact and risk scales from the risk management strategy
Information sources	Fill in: for example control assessment results, vulnerability scans, penetration tests, threat intelligence, incident history, interviews

Guidance

If the organization has not yet set its own scale, SP 800-30 Rev. 1 Appendix I, Table I-2, “Assessment Scale – Level of Risk (Combination of Likelihood and Impact)”, combines five levels of likelihood and impact as shown below.

Likelihood	Very low impact	Low impact	Moderate impact	High impact	Very high impact
Very high	Very low	Low	Moderate	High	Very high
High	Very low	Low	Moderate	High	Very high
Moderate	Very low	Low	Moderate	Moderate	High
Low	Very low	Low	Low	Low	Moderate
Very low	Very low	Very low	Very low	Low	Low

5. Results

The assessment identified threats to and vulnerabilities in the system (RA-3a.1), and determined the likelihood and magnitude of harm to the organization, its information and related information (RA-3a.2) and, where the system processes personally identifiable information, the likelihood and impact of adverse effects on individuals (RA-3a.3).

ID	Threat source and event	Vulnerability or predisposing condition	Likelihood	Impact	Risk level	Recommended response
Fill in: ID from the risk register	Fill in: threat source and event	Fill in: vulnerability or condition	Fill in: level	Fill in: level	Fill in: level	Fill in: accept, avoid, mitigate, share or transfer, with the action
Fill in: ID	Fill in: threat source and event	Fill in: vulnerability or condition	Fill in: level	Fill in: level	Fill in: level	Fill in: response

5.1 Risks to individuals

Fill in: the privacy risks found, with likelihood, impact and recommended response, or “the system does not process personally identifiable information” (RA-3a.3)

5.2 Supply chain risks

Supply chain risks were assessed for Fill in: systems, system components, and system services to assess supply chain risks Typical: each system, the components and services the criticality analysis (RA-9) identifies as critical, and the external services the system depends on (RA-3(1)(a)). Fill in: the suppliers, products and services considered, the risks found and the recommended responses

6. Documentation, review and distribution

• The System owner shall keep this report as the record of the risk assessment results. (RA-3c)
• The System owner shall review the results Fill in: the frequency to review risk assessment results Typical: annually. (RA-3d)
• The System owner shall share the results with Fill in: personnel or roles to whom risk assessment results are to be disseminated Typical: the authorizing official, the system owner and the Chief Information Security Officer. (RA-3e)
• The System owner shall update the assessment Fill in: the frequency to update the risk assessment Typical: at least every three years, and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

Version	Date	Reviewed or updated by	Summary of change	Shared with
Fill in: version	Fill in: date	Fill in: name and title	Fill in: summary	Fill in: recipients

Appendix A. Assessment team and sources

Fill in: the assessment team members and their roles, and the documents, tools and people consulted

Appendix B. Supporting data

Fill in: the detailed threat, vulnerability, likelihood and impact analysis behind section 5, or a reference to where it is kept