Risk Assessment Decision Worksheet

Risk Assessment Decision Worksheet template: Every decision the Risk Assessment family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Risk Assessment family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every RA control in the baseline, with a typical value where the Risk Assessment Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

29 decisions.

Decision	Control	Typical value	Who decides
Which risk assessment method and scale do systems use?	RA-3	NIST SP 800-30 Rev. 1, with the likelihood, impact and risk scales set in the risk management strategy.	Chief Information Security Officer
Who runs vulnerability scanning, and who fixes what it finds?	RA-5	A central vulnerability management team runs the scanning tools and tracks findings; each system owner fixes findings on their system.	Chief Information Security Officer
Where is the public vulnerability disclosure policy published, and who handles the reports?	RA-5(11)	A page on the organization’s public website, with reports going to the security operations team.	Chief Information Security Officer
How does a system or project find out whether it needs a privacy impact assessment, and who approves the assessment?	RA-8	A short privacy screening questionnaire for every new system, project or collection; the senior privacy official approves each assessment.	Senior privacy official
Personnel or roles to whom the risk assessment policy is to be disseminated	RA-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the risk assessment procedures are to be disseminated	RA-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	RA-1	Organization-level	Chief Information Security Officer
An official to manage the risk assessment policy and procedures	RA-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current risk assessment policy is reviewed and updated	RA-1	Annually	Chief Information Security Officer
Events that would require the current risk assessment policy to be reviewed and updated	RA-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current risk assessment procedures are reviewed and updated	RA-1	Annually	Chief Information Security Officer
Events that would require risk assessment procedures to be reviewed and updated	RA-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Select one: security and privacy plans; risk assessment report; organization-defined document (see its row below)	RA-3	Risk assessment report	Chief Information Security Officer
A document in which risk assessment results are to be documented (if not documented in the security and privacy plans or risk assessment report)	RA-3	See the selection above	Chief Information Security Officer
The frequency to review risk assessment results	RA-3	Annually	Chief Information Security Officer
Personnel or roles to whom risk assessment results are to be disseminated	RA-3	The authorizing official, the system owner and the Chief Information Security Officer	Chief Information Security Officer
The frequency to update the risk assessment	RA-3	At least every three years	Chief Information Security Officer
Systems, system components, and system services to assess supply chain risks	RA-3(1)	Each system, the components and services the criticality analysis (RA-9) identifies as critical, and the external services the system depends on	Chief Information Security Officer
The frequency at which to update the supply chain risk assessment	RA-3(1)	Annually	Chief Information Security Officer
Frequency for monitoring systems and hosted applications for vulnerabilities	RA-5	Continuously, through vendor advisories, vulnerability feeds and the CISA Known Exploited Vulnerabilities Catalog	Chief Information Security Officer
Frequency for scanning systems and hosted applications for vulnerabilities	RA-5	At least monthly for infrastructure, and before each major release for applications	Chief Information Security Officer
Response times to remediate legitimate vulnerabilities in accordance with an organizational assessment of risk	RA-5	Known exploited: as soon as possible, within days; critical and high: 30 days; moderate: 90 days; low: 180 days	Chief Information Security Officer
Personnel or roles with whom information obtained from the vulnerability scanning process and control assessments is to be shared	RA-5	The owners of similar systems and the security operations team	Chief Information Security Officer
Select one or more: organization-defined frequency (see its row below); prior to a new scan; when new vulnerabilities are identified and reported	RA-5(2)	Prior to a new scan	Chief Information Security Officer
The frequency for updating the system vulnerabilities to be scanned	RA-5(2)	See the selection above	Chief Information Security Officer
System components to which privileged access is authorized for selected vulnerability scanning activities	RA-5(5)	Operating systems, databases and web applications	Chief Information Security Officer
Vulnerability scanning activities selected for privileged access authorization to system components	RA-5(5)	Credentialed (authenticated) vulnerability scans	Chief Information Security Officer
Systems, system components, or system services to be analyzed for criticality	RA-9	Each Moderate and High system, and the components and services that support its critical functions	Chief Information Security Officer
Decision points in the system development life cycle when a criticality analysis is to be performed	RA-9	During design, before acquiring major components or services, and when the architecture changes significantly	Chief Information Security Officer