NIST SP 800-30 Risk Assessment: A Template and Worked Example

Most teams that say they "do a risk assessment" actually do a feelings assessment: someone eyeballs a finding, declares it High, and moves on. NIST SP 800-30 Rev. 1 exists to make that defensible. It gives you a repeatable model (threat source, threat event, vulnerability, likelihood, impact, risk) and a set of assessment scales so two assessors looking at the same system land in roughly the same place. This article is a working NIST risk assessment template: we walk the model once, then score three real risks end to end so you can see exactly where each number comes from.

None of this requires a tool. You can run an 800-30 risk assessment in a spreadsheet. The catch is that the math (combining likelihood and impact into a risk level, keeping the scales consistent across 40 rows) is exactly the part people get wrong under deadline pressure. We will note where a tool does the bookkeeping for you, but the model is the point.

The SP 800-30 risk model, in one pass

SP 800-30 defines risk as a function of two things: the likelihood that a threat event occurs and causes adverse impact, and the magnitude of that impact. Getting to those two numbers is a chain, and skipping links is how assessments lose their audit trail. Here is the full chain for a single risk:

• Threat source. The entity that could cause harm. SP 800-30 splits these into adversarial (an attacker with capability, intent, and targeting) and non-adversarial (human error, equipment failure, environmental events). This distinction matters because it changes how you estimate likelihood.
• Threat event. What the source actually does. "Adversary exfiltrates data via a compromised admin credential" is a threat event. "Hackers" is not.
• Vulnerability and predisposing condition. The weakness the event exploits, plus any condition that makes the system more or less susceptible (for example, internet exposure, or a missing MFA control). SP 800-30 treats severity of the vulnerability and pervasiveness of the predisposing condition as inputs to likelihood.
• Likelihood. For adversarial threats, this is itself two sub-judgments per SP 800-30: the likelihood the event is initiated, and the likelihood that, once initiated, it results in adverse impact. The overall likelihood is the combination.
• Impact. The magnitude of harm to operations, assets, individuals, other organizations, or the Nation if the event succeeds.
• Risk. The determination produced by combining overall likelihood and impact, read off the risk matrix.

The assessment scales (and the semi-quantitative numbers)

SP 800-30 uses a five-level qualitative scale for likelihood, impact, and risk: Very Low, Low, Moderate, High, Very High. Appendices G, H, and I also pin each level to a semi-quantitative range so the labels are not arbitrary. These are the values from the SP 800-30 Rev. 1 assessment scales:

The same five-level scale carries semantic anchors. For an adversarial threat, likelihood of initiation reads as: Very High means the adversary is almost certain to initiate; High, highly likely; Moderate, somewhat likely; Low, unlikely; Very Low, highly unlikely. For impact, Very High means a severe or catastrophic effect (multiple severe mission failures, major financial loss, loss of life); Low means a limited effect. Anchor your scale to those definitions before the first row, or every assessor will privately recalibrate "Moderate."

Qualitative vs. semi-quantitative: pick one and stay consistent

SP 800-30 supports qualitative, semi-quantitative, and quantitative analysis. The two you will actually use:

The risk determination matrix

Once you have an overall likelihood level and an impact level, the risk level is not a multiplication. It is a lookup. SP 800-30 Rev. 1 publishes a 5x5 combination matrix in Appendix I, Table I-3 (the level of risk as a combination of likelihood and impact; Table I-2 in the same appendix is the descriptive level-of-risk scale). Likelihood is the row, impact is the column, and the cell is the resulting risk:

Two things practitioners miss here. First, the matrix is not symmetric: a High-likelihood, Very-Low-impact event is only Very Low risk, but a Very-Low-likelihood, Very-High-impact event is Low, not Very Low. NIST weights impact a little harder at the extremes. Second, impact caps risk hard. If the worst credible impact is Low, the risk cannot exceed Low no matter how certain the event is. That is the column on the far left doing its job, and it is why scoping impact honestly matters more than agonizing over likelihood.

Worked example: three risks, scored end to end

Here is a filled-in 800-30 risk assessment template for a notional internet-facing web application that handles PII. Each row carries the full chain so the rating is traceable. Likelihood and impact use the qualitative levels; the parenthetical is the representative semi-quantitative value for prioritization.

Walk the first row to see the discipline. The threat event is a specific, verbed statement. The likelihood is High, not Very High: the endpoint is exposed and the flaw is real, but exploitation still requires the adversary to find and weaponize it, so initiation is "highly likely" rather than "almost certain." Impact is Very High because a full PII exfiltration is a reportable breach with severe organizational and individual harm. High likelihood crossed with Very High impact lands on Very High risk in the matrix. No multiplication, just the lookup.

The second and third rows are instructive because they tie at Moderate from opposite directions. Credential stuffing is High likelihood but only Moderate impact (single accounts, not the whole datastore), so it caps at Moderate. The bucket misconfiguration is only Moderate likelihood (it takes a specific human mistake) but High impact, and it also lands on Moderate. The semi-quantitative values (both effectively mid-band) let you note they are genuinely comparable, then prioritize on cost-to-fix: rate limiting plus MFA is cheaper than an IaC guardrail program, so the credential-stuffing risk gets remediated first even though the residual risk math is identical.

Where the tool does the 800-30 math

The model is simple; the bookkeeping is what rots. Keeping the scale anchors consistent across every row, re-reading the matrix correctly every time, and not letting "Moderate" drift are the failure modes. Our free Risk Assessment tool implements SP 800-30 Rev. 1 directly: you capture threat sources, threat events, vulnerabilities, and predisposing conditions, choose likelihood and impact on the five-level semi-quantitative scale, and it applies the risk-determination matrix for you so the rating is the same every time. It runs entirely in your browser, no account, and your assessment data never leaves your device.

From there the scored risks push straight into a Risk Register (SP 800-37/39), which is where ongoing risk response and monitoring live. The assessment is the snapshot; the register is the running ledger. With Pro you can save, export to JSON or CSV, print the assessment as a PDF, and roll multiple systems into a dashboard, but the assessment itself, and all of the 800-30 math above, is free.

A short checklist for a defensible assessment

• Scope it: name the system, the data it holds, and the boundary before you list a single threat.
• Write every threat event as a verbed sentence tied to a specific vulnerability and predisposing condition.
• Separate adversarial from non-adversarial sources; estimate likelihood differently for each.
• Anchor your five-level scales to the SP 800-30 definitions, in writing, and do not redefine them mid-assessment.
• Derive risk from the matrix, not from arithmetic. Let impact cap the rating.
• Record the semi-quantitative value to break ties, but never present it as a measured probability.
• Feed the results into a risk register so response decisions and residual risk are tracked over time.

Do that, and "we did a risk assessment" becomes a sentence you can defend to an assessor, line by line, instead of a number you hope no one questions.

Frequently asked questions

How does SP 800-30 define risk?

SP 800-30 defines risk as a function of two things: the likelihood that a threat event occurs and causes adverse impact, and the magnitude of that impact. Getting to those two numbers is a chain (threat source, threat event, vulnerability, likelihood, impact, risk), and skipping links is how assessments lose their audit trail.

Do the SP 800-30 semi-quantitative numbers mean a precise probability or dollar figure?

No. The semi-quantitative numbers are not a precise probability or a dollar figure. A "65" is a Moderate that you judged to sit in the upper part of the Moderate band, nothing more. SP 800-30 is explicit that these scales are exemplary and meant to be tailored. Treat the number as a tiebreaker for prioritization, not as a measured quantity.

How do you get the risk level from likelihood and impact in SP 800-30?

Once you have an overall likelihood level and an impact level, the risk level is not a multiplication. It is a lookup. SP 800-30 Rev. 1 publishes a 5x5 combination matrix in Appendix I, Table I-3, where likelihood is the row, impact is the column, and the cell is the resulting risk. The matrix is not symmetric, and impact caps risk hard: if the worst credible impact is Low, the risk cannot exceed Low no matter how certain the event is.

Should I use qualitative or semi-quantitative analysis for an 800-30 assessment?

SP 800-30 supports qualitative, semi-quantitative, and quantitative analysis. Qualitative records just the labels (Low, Moderate, High): it is fast and easy to explain, but hard to rank two "High" risks against each other. Semi-quantitative records a label plus a number from the 0-100 bins (or 0-10): it lets you sort and prioritize within a level and supports roll-ups, but tempts people to over-trust the number as if it were measured. Pick one and stay consistent.

Related reading

• What Is Risk? The NIST Definition and Why It Changes How You Assess
• Why Your Heat Map Doesn't Match Your Risk Score
• The POA&M: Why Tracking Remediation Is What Keeps Your ATO Alive
• the free SP 800-30 risk assessment tool