<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-risk-assessment-nist-800-30
description: >-
  Perform risk assessments following NIST SP 800-30 Rev 1 methodology including
  threat identification, vulnerability analysis, likelihood/impact determination,
  and risk scoring with automated data collection and risk register management.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - risk-assessment
  - nist-800-30
  - threat-modeling
  - risk-register
  - likelihood
  - impact
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Risk Assessment (NIST 800-30)

## Overview

NIST SP 800-30 Rev 1 provides guidance for conducting risk assessments of
information systems. This skill automates threat source identification,
vulnerability enumeration, likelihood/impact analysis, and risk determination
with structured risk register output.

Mode: `[MODE: ARCHITECT]` — Risk assessment methodology and scoring.

## Prerequisites

| Requirement | Details |
|---|---|
| Vulnerability scanner (Nessus, OpenVAS, or Trivy) | Required |
| Asset inventory system | Required |
| `pip install risk-assessment-tools` | Required |

## Key Concepts

### NIST 800-30 Risk Assessment Process

```
Risk Assessment Steps:
├── Step 1: Prepare for Assessment
│   ├── Define purpose, scope, assumptions
│   ├── Identify information sources
│   └── Define risk model and assessment approach
├── Step 2: Conduct Assessment
│   ├── Identify threat sources and events
│   ├── Identify vulnerabilities and predisposing conditions
│   ├── Determine likelihood of occurrence
│   ├── Determine magnitude of impact
│   └── Determine risk (likelihood × impact)
├── Step 3: Communicate Results
│   ├── Risk register with prioritized findings
│   ├── Executive summary for leadership
│   └── Detailed technical findings
└── Step 4: Maintain Assessment
    ├── Monitor risk factors for changes
    ├── Update assessment as environment changes
    └── Trigger reassessment on significant events
```

### Likelihood and Impact Scales

```
Likelihood Scale (Qualitative):
├── Very High (10): Almost certain to occur
├── High (8):       Highly likely to occur
├── Moderate (5):   Somewhat likely to occur
├── Low (2):        Unlikely but possible
└── Very Low (1):   Improbable

Impact Scale (Qualitative):
├── Very High (10): Catastrophic — mission failure, loss of life
├── High (8):       Severe — significant degradation of mission
├── Moderate (5):   Serious — degradation but mission continues
├── Low (2):        Limited — minor degradation
└── Very Low (1):   Negligible — no meaningful impact

Risk Determination: Likelihood × Impact
├── Critical (50-100): Immediate action required
├── High (25-49):      Priority remediation within 30 days
├── Moderate (10-24):  Remediation within 90 days
├── Low (2-9):         Accept or remediate within 180 days
└── Very Low (1):      Accept risk
```

### Automated Threat Source Identification

```bash
# Enumerate external threats via vulnerability scanning
nmap -sV --script vulners -oX /tmp/vuln-scan.xml 10.0.0.0/24

# Container image vulnerability assessment
trivy image --severity HIGH,CRITICAL --format json app:latest > /tmp/trivy.json

# AWS threat landscape (GuardDuty findings)
aws guardduty list-findings --detector-id $DETECTOR_ID \
  --finding-criteria '{"Severity":{"Gte":7}}' --output json

# Aggregate CVE data for risk scoring
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=apache&resultsPerPage=10" | \
  jq '.vulnerabilities[].cve | {id: .id, score: .metrics.cvssMetricV31[0].cvssData.baseScore}'
```

### Risk Register Template

```json
{
  "risk_id": "RISK-001",
  "threat_source": "External attacker",
  "threat_event": "SQL injection on public-facing application",
  "vulnerability": "Unsanitized user input in query builder",
  "predisposing_condition": "Legacy application without WAF",
  "likelihood": 8,
  "impact": 8,
  "risk_score": 64,
  "risk_level": "Critical",
  "existing_controls": ["Input validation (partial)", "Network firewall"],
  "recommended_controls": ["Parameterized queries", "WAF deployment", "DAST scanning"],
  "risk_response": "mitigate",
  "owner": "Application Security Team",
  "due_date": "2026-04-15"
}
```

## Workflow

### Step 1: Identify Threats and Vulnerabilities

```bash
node scripts/agent.js --action identify --target-network 10.0.0.0/24 \
  --output /tmp/risk-threats.json
```

### Step 2: Analyze and Score Risks

```bash
node scripts/agent.js --action analyze --input /tmp/risk-threats.json \
  --output /tmp/risk-analysis.json
```

### Step 3: Generate Risk Register

```bash
node scripts/agent.js --action register --input /tmp/risk-analysis.json \
  --output /tmp/risk-register.json
```

## Verification

- [ ] Assessment scope and purpose documented
- [ ] Threat sources identified (adversarial, accidental, structural, environmental)
- [ ] Vulnerabilities enumerated from scanning and manual analysis
- [ ] Likelihood and impact rated on consistent scale
- [ ] Risk register produced with prioritized findings
- [ ] Risk response selected for each finding (mitigate, accept, transfer, avoid)
- [ ] Assessment scheduled for periodic update

## References

- [NIST SP 800-30 Rev 1](https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final)
- [NIST SP 800-39 — Managing Information Security Risk](https://csrc.nist.gov/publications/detail/sp/800-39/final)
