# Risk Assessment Report (NIST SP 800-30 Rev 1) — Worked Example

> Filled example for a mid-size SaaS company assessing its internet-facing
> application tier. Replace bracketed content for your own assessment.

## 1. Purpose, Scope, and Tier
- **Purpose:** Inform control-investment decisions for FY26 and satisfy the documented risk-analysis input required by the company's SOC 2 (CC3) program and ISO 27001 Clause 6.1.2.
- **Scope:** Internet-facing application tier — customer web portal, its identity provider (IdP), the API gateway, and the data lake behind them.
- **Risk-management tier (SP 800-39):** Tier 3 (information system), rolling up to Tier 2 (the "Customer Platform" mission).
- **Assessment window:** FY26 Q2; valid 12 months or until a triggering change.

## 2. Assumptions, Constraints, and Risk Model
- **Assumptions:** A financially motivated external adversary of moderate-to-high capability is actively targeting the sector; internal users are trusted but fallible.
- **Constraints:** Assessment is architecture- and scan-driven; no red-team engagement was run this cycle.
- **Risk model:** Factors = threat source, threat event, vulnerability/predisposing condition, likelihood, impact. Adversarial threat events are mapped to MITRE ATT&CK.
- **Scales:** Five-level qualitative (Very Low → Very High). Risk computed via the 800-30 Rev 1 reference 5×5 matrix (see `references/standards.md`). This matrix was agreed during Prepare and is locked for the cycle.

## 3. Threat Sources (Appendix D)
| Source | Type | Characterization |
|---|---|---|
| Organized cybercrime group | Adversarial | High capability, financial intent, opportunistic + targeted |
| Authorized employee | Accidental | Misconfiguration / human error |
| Hardware/software failure | Structural | Storage, service, or dependency failure |
| Regional power / cloud-region outage | Environmental | Low frequency, availability impact |

## 4. Threat Events (Appendix E)
| ID | Threat event | Source | ATT&CK |
|---|---|---|---|
| R-01 | Adversary phishes employee credentials, then moves laterally to the IdP | Adversarial | T1566, T1021 |
| R-02 | Adversary exploits an unpatched edge VPN to deploy ransomware | Adversarial | T1190 |
| R-04 | Employee misconfigures a data-lake bucket to public | Accidental | — |
| R-03 | SIEM storage disk fails, corrupting un-backed-up logs | Structural | — |

## 5. Vulnerabilities and Predisposing Conditions (Appendix F)
| Threat event | Vulnerabilities / conditions |
|---|---|
| R-01 | No phishing-resistant MFA; flat internal network (no segmentation) |
| R-02 | VPN appliance missing a critical patch; internet-exposed management plane |
| R-04 | No preventive SCP/guardrail; broad write permissions on storage |
| R-03 | No RAID; no offsite/immutable backup of SIEM data |

## 6. Risk Register
*(generated by `scripts/process.py`; likelihood × impact → risk on the 800-30 5×5 matrix, ranked highest-first)*

| ID | Threat event | Source | Asset | ATT&CK | Likelihood | Impact | Risk | Key vulnerabilities | Treatment | Residual | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|
| R-01 | Phish → lateral movement to IdP | Adversarial | Identity provider | T1566, T1021 | High | Very High | **Very High** | No phishing-resistant MFA; flat network | Mitigate | Moderate | IAM Lead |
| R-02 | Ransomware via unpatched edge VPN | Adversarial | VPN concentrator | T1190 | Moderate | Very High | **High** | Missing critical patch | Mitigate | Low | Infra |
| R-04 | Public S3 misconfiguration | Accidental | Data lake | — | Moderate | High | **Moderate** | No SCP guardrail | Mitigate | Low | Cloud |
| R-03 | Disk failure corrupts logs | Structural | SIEM storage | — | Low | Moderate | **Low** | No RAID; no offsite backup | Accept | Low | SOC |

## 7. Top Risks Summary (for leadership)
1. **R-01 — Very High.** A successful phish into our identity provider is the single most damaging plausible event: it grants broad access and, on a flat network, fast lateral movement. **Recommendation:** deploy phishing-resistant MFA (FIDO2) and segment the IdP — this is the highest-leverage control this fiscal year.
2. **R-02 — High.** Edge-VPN ransomware is a sector-common entry path. **Recommendation:** emergency-patch the appliance, restrict the management plane, and validate offline backups.
3. **R-04 — Moderate.** Cloud misconfiguration is likely but bounded; a preventive SCP guardrail collapses the likelihood cheaply.

## 8. Maintenance Plan
- **Cadence:** Full re-assessment annually; register reviewed quarterly.
- **Re-assessment triggers:** new internet-facing system, major architecture change, any incident affecting in-scope assets, or significant new threat intel (e.g., active exploitation of a component we run).
- **Tracking:** Treatment progress and risk-acceptance signatures recorded in the GRC tool; residual risk re-scored after each control lands to show year-over-year movement.
