NIST Guidance

NIST 800-14 § 3.3.1 suggests that risk analysis is composed of a few sections:

• Determine the Assessment’s Scope and Methodology

• Collecting and Analyzing Data

• Interpreting Risk Assessment Results

Determining the assessment’s scope and methodology includes identifying the system under consideration, the part of the system that will be analyzed, and the analytical method including its level of detail and formality.

Collecting and analyzing data involves examining the multiple components of risk to see which are most pertinent. Components include asset valuation, consequence assessment, threat identification, safeguard analysis, vulnerability analysis and likelihood assessment.

Interpreting risk assessment results involves reviewing the results of assessment to determine what risks are of most concern to the organization.

NIST 800-53 § RA-3 states that a good risk assessment takes into account all that is known about vulnerabilities, threat sources, and security controls planned or in place to determine the resulting level of residual risk posed to organizational operations, organizational assets, or individuals based on the operation of the information system. During the course of analyzing risks, it should be determined what risks are greatest, which are most likely to occur and how to deal with each of them.