Anthropic-Cybersecurity-Skills/skills/conducting-cyber-risk-assessment-with-nist-800-30/assets/template.md

Risk Assessment Report (NIST SP 800-30 Rev 1) — Worked Example

Filled example for a mid-size SaaS company assessing its internet-facing application tier. Replace bracketed content for your own assessment.

1. Purpose, Scope, and Tier

• Purpose: Inform control-investment decisions for FY26 and satisfy the documented risk-analysis input required by the company's SOC 2 (CC3) program and ISO 27001 Clause 6.1.2.
• Scope: Internet-facing application tier — customer web portal, its identity provider (IdP), the API gateway, and the data lake behind them.
• Risk-management tier (SP 800-39): Tier 3 (information system), rolling up to Tier 2 (the "Customer Platform" mission).
• Assessment window: FY26 Q2; valid 12 months or until a triggering change.

2. Assumptions, Constraints, and Risk Model

• Assumptions: A financially motivated external adversary of moderate-to-high capability is actively targeting the sector; internal users are trusted but fallible.
• Constraints: Assessment is architecture- and scan-driven; no red-team engagement was run this cycle.
• Risk model: Factors = threat source, threat event, vulnerability/predisposing condition, likelihood, impact. Adversarial threat events are mapped to MITRE ATT&CK.
• Scales: Five-level qualitative (Very Low → Very High). Risk computed via the 800-30 Rev 1 reference 5×5 matrix (see references/standards.md). This matrix was agreed during Prepare and is locked for the cycle.

3. Threat Sources (Appendix D)

Source	Type	Characterization
Organized cybercrime group	Adversarial	High capability, financial intent, opportunistic + targeted
Authorized employee	Accidental	Misconfiguration / human error
Hardware/software failure	Structural	Storage, service, or dependency failure
Regional power / cloud-region outage	Environmental	Low frequency, availability impact

4. Threat Events (Appendix E)

ID	Threat event	Source	ATT&CK
R-01	Adversary phishes employee credentials, then moves laterally to the IdP	Adversarial	T1566, T1021
R-02	Adversary exploits an unpatched edge VPN to deploy ransomware	Adversarial	T1190
R-04	Employee misconfigures a data-lake bucket to public	Accidental	—
R-03	SIEM storage disk fails, corrupting un-backed-up logs	Structural	—

5. Vulnerabilities and Predisposing Conditions (Appendix F)

Threat event	Vulnerabilities / conditions
R-01	No phishing-resistant MFA; flat internal network (no segmentation)
R-02	VPN appliance missing a critical patch; internet-exposed management plane
R-04	No preventive SCP/guardrail; broad write permissions on storage
R-03	No RAID; no offsite/immutable backup of SIEM data

6. Risk Register

(generated by scripts/process.py; likelihood × impact → risk on the 800-30 5×5 matrix, ranked highest-first)

ID	Threat event	Source	Asset	ATT&CK	Likelihood	Impact	Risk	Key vulnerabilities	Treatment	Residual	Owner
R-01	Phish → lateral movement to IdP	Adversarial	Identity provider	T1566, T1021	High	Very High	Very High	No phishing-resistant MFA; flat network	Mitigate	Moderate	IAM Lead
R-02	Ransomware via unpatched edge VPN	Adversarial	VPN concentrator	T1190	Moderate	Very High	High	Missing critical patch	Mitigate	Low	Infra
R-04	Public S3 misconfiguration	Accidental	Data lake	—	Moderate	High	Moderate	No SCP guardrail	Mitigate	Low	Cloud
R-03	Disk failure corrupts logs	Structural	SIEM storage	—	Low	Moderate	Low	No RAID; no offsite backup	Accept	Low	SOC

7. Top Risks Summary (for leadership)

1. R-01 — Very High. A successful phish into our identity provider is the single most damaging plausible event: it grants broad access and, on a flat network, fast lateral movement. Recommendation: deploy phishing-resistant MFA (FIDO2) and segment the IdP — this is the highest-leverage control this fiscal year.
2. R-02 — High. Edge-VPN ransomware is a sector-common entry path. Recommendation: emergency-patch the appliance, restrict the management plane, and validate offline backups.
3. R-04 — Moderate. Cloud misconfiguration is likely but bounded; a preventive SCP guardrail collapses the likelihood cheaply.

8. Maintenance Plan

• Cadence: Full re-assessment annually; register reviewed quarterly.
• Re-assessment triggers: new internet-facing system, major architecture change, any incident affecting in-scope assets, or significant new threat intel (e.g., active exploitation of a component we run).
• Tracking: Treatment progress and risk-acceptance signatures recorded in the GRC tool; residual risk re-scored after each control lands to show year-over-year movement.