<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-enterprise-risk-assessment
description: >-
  Conduct enterprise-wide risk assessments using quantitative and qualitative methodologies including FAIR, NIST 800-30, ISO 31000, and OCTAVE to identify, analyze, and evaluate organizational risks.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - risk-assessment
  - fair
  - nist-800-30
  - iso-31000
  - octave
  - quantitative-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Enterprise Risk Assessment

## Overview

Enterprise risk assessment identifies threats, vulnerabilities, and impacts across the organization. This technique covers both qualitative (likelihood × impact matrices) and quantitative (FAIR model, Monte Carlo simulations) approaches with integration into business decision-making.

Mode: `[MODE: ARCHITECT]` — Enterprise risk assessment methodology and execution.

## Prerequisites

| Requirement | Details |
|---|---|
| Risk assessment framework | NIST 800-30 or ISO 31000 |
| Asset inventory | Complete asset register |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Risk Assessment Methodology

```
Assessment approaches:
├── Qualitative (likelihood × impact matrix)
│   ├── 5×5 risk matrix (Very Low to Very High)
│   ├── Scenario-based assessment
│   ├── Expert judgment and Delphi method
│   └── Output: risk ratings (Critical/High/Medium/Low)
├── Quantitative (FAIR model)
│   ├── Loss Event Frequency (LEF)
│   ├── Loss Magnitude (LM)
│   ├── Monte Carlo simulation (10,000+ iterations)
│   └── Output: annualized loss expectancy (ALE) in dollars
└── Hybrid approach
    ├── Qualitative for initial triage
    ├── Quantitative for top risks
    └── Business context for prioritization
```

### 2. NIST 800-30 Risk Assessment

```
Steps:
├── Step 1: Prepare for assessment
│   ├── Define scope and boundaries
│   ├── Identify threat sources and events
│   └── Identify vulnerabilities and conditions
├── Step 2: Conduct assessment
│   ├── Determine likelihood of threat events
│   ├── Determine impact magnitude
│   └── Calculate risk (likelihood × impact)
├── Step 3: Communicate results
│   ├── Risk determination matrix
│   ├── Prioritized risk register entries
│   └── Executive summary with recommendations
└── Step 4: Maintain assessment
    ├── Monitor risk factors for changes
    ├── Update on significant change events
    └── Annual reassessment cycle
```

### 3. FAIR Quantitative Model

```
Factor Analysis of Information Risk (FAIR):
├── Risk = Loss Event Frequency × Loss Magnitude
├── LEF = Threat Event Frequency × Vulnerability
├── Loss Magnitude components:
│   ├── Primary Loss: productivity, response, replacement
│   ├── Secondary Loss: fines, reputation, legal
│   └── Total: sum across all loss categories
└── Monte Carlo simulation:
    ├── Define min/likely/max for each input
    ├── Run 10,000+ iterations
    ├── Output: probability distribution of ALE
    └── Report: 10th, 50th, 90th percentile values
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
