What category of publication this is
NIST Special Publication 800-30 Revision 1 is the subject. The official title is Guide for Conducting Risk Assessments. The CSRC abstract states that its purpose is guidance to conduct risk assessments of federal information systems and organizations. It amplifies the guidance in Special Publication 800-39. Assessments at all three tiers in the risk management hierarchy are part of an overall risk management process. They give senior leaders the information that they need to choose a course of action in response to identified risks.
A common misread treats a risk assessment as a one-page form. Another misread holds that a risk register means the Risk Management Framework is finished. SP 800-30 is a publication. It is not a statute. It is not a score product.
Edition covered
SP 800-30 Rev. 1, Date Published September 2012. Document history on the CSRC page stamps Final on 2012-09-17 (shown there as 09/17/12). DOI 10.6028/NIST.SP.800-30r1. The PDF is nistspecialpublication800-30r1 on nvlpubs. This Final supersedes SP 800-30 (07/01/2002).
Document history on that page ends at Final 2012-09-17. Rev. 1 is the current Final there as of this review (2026-09-26). If a newer Final appears, this pin must change. The older claim is then UNKNOWN.
Where this publication sits
SP 800-39 has the official title Managing Information Security Risk: Organization, Mission, and Information System View. It is Final 2011-03-01 (CSRC history 03/01/11). SP 800-30 describes it as the publication that defines organization-wide information security risk management. The component themes in that description are frame, assess, respond, and monitor. SP 800-39 is the management publication. SP 800-30 specializes the assess component.
SP 800-37 Rev. 2 is the Risk Management Framework. The steps are Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Risk assessments inform those activities. An assessment document is not the seven steps finished.
Four steps
Chapter 3 of SP 800-30 Rev. 1 lists four steps. The steps are prepare, conduct, communicate, and maintain. Prepare sets purpose, scope, assumptions, constraints, information sources, and the risk model. Conduct covers threat sources and events, and vulnerabilities and predisposing conditions. It then covers likelihood, impact, and a risk determination. Communicate shares results with decision makers. Maintain revisits the assessment when systems, threats, missions, or environments change.
The publication states that organizations have flexibility on formality, methods, and tools. It also states that risk assessments are often not precise instruments. Uncertainty is normal. It does not mean that the assessment failed.
Three tiers
The same publication supports three altitudes. Tier 1 is the organization. Tier 2 is the mission or business process. Tier 3 is the information system. An assessment can be aimed at one of those tiers. The altitude changes the question. It does not turn the four steps into a different publication.
Tier 3 work can inform system-level Risk Management Framework tasks.
What SP 800-30 is not
SP 800-30 is not a do-it-yourself heat map. It is not FedRAMP homework (FedRAMP: federal cloud authorization). It is not an SP 800-53 family dump (NIST SP 800-53: choosing security and privacy controls and NIST SP 800-53). It is not an SP 800-137 ISCM program (NIST SP 800-137: continuous monitoring).
A risk register row is not permission to skip prepare, communicate, or maintain.
Whether a specific agency holds an Authorization is UNKNOWN. Whether a private team must run federal 800-30 templates verbatim is also UNKNOWN. The PDF states that nongovernmental organizations can use the publication on a voluntary basis. Coverage questions escalate to counsel, the authorizing official, or the GRC owner.
Rewrite the one-line claim
The claim "we are RMF, 800-30, FedRAMP, and NIST risk compliant" mixes four objects. Exact replacement: "We use SP 800-30 Rev. 1 for risk assessments (prepare, conduct, communicate, maintain)." That use informs the RMF seven steps, a FedRAMP lane, or catalog selection. It is not the same as any of them.
The team picks one system that it touches. The team privately decides whether the live question is frame, assess, respond, or monitor. The team also decides which lane actually applies, such as an agency RMF or some other lane.
An assessment is not RMF finished and not FedRAMP
| Phrase people use | Literacy correction |
|---|---|
| We finished a risk assessment, so RMF is done | An assessment informs RMF. The seven RMF steps are a broader process. Explainer: /learn/explainers/sp-800-37/. |
| Risk assessment = FedRAMP package | FedRAMP is a cloud Authorization reuse lane. The vocabulary is related, but the object is different. Explainer: /learn/explainers/fedramp/. |
| Risk assessment = dump every 800-53 family | SP 800-53 is a control catalog. An assessment is not a family homework dump. Explainer: /learn/explainers/sp-800-53/. Reference card: /reference/frameworks/nist-sp-800-53-r5/. |
| Risk assessment = ATO | A senior official makes the Authorization decision. |
| GRC evidence lab artifact = 800-30 assessment complete | The GRC lab practices an evidence and exception habit. It is not a federal risk-assessment package. Lab: /labs/grc-evidence-exception/. |
| Risk register exists, so we can skip prepare/communicate/maintain | A register row is not the four-step assessment discipline. Prepare, communicate, and maintain still apply. |
Common misconceptions
A filled risk matrix, or a risk register, means RMF is complete.
An assessment informs the seven RMF steps. A matrix or a register row is not those steps finished. It does not skip prepare, communicate, or maintain.
SP 800-30, SP 800-37, FedRAMP, and SP 800-53 are the same homework.
800-30 is assessment guidance. 800-37 is the RMF process. FedRAMP is a cloud Authorization lane. 800-53 is a control catalog. The vocabulary is related, but the objects are different.
An 800-30 assessment grants the Authorization to Operate.
An Authorization to Operate is a risk-based decision of a senior official. An assessment informs that decision.
Uncertainty means the assessment failed.
The publication states that assessments are often not precise instruments. Uncertainty is normal. The habit is to record what is still unknown.
A private team must run federal 800-30 templates verbatim.
Nongovernmental use is voluntary in the PDF. Whether a specific team must follow the templates is UNKNOWN. The question escalates to counsel, the authorizing official, or the GRC owner.
Prepare, conduct, communicate, maintain
The steps come from SP 800-30 Rev. 1, Chapter 3.
| Step | One-line literacy | Boundary |
|---|---|---|
| Prepare | Purpose, scope, assumptions, constraints, information sources, and the risk model, before any score folklore | Context first. Not a score. |
| Conduct | Threat sources and events, vulnerabilities and predisposing conditions, then likelihood, impact, and risk determination themes | Themes only. The appendix tables stay in the PDF. |
| Communicate | Results go to decision makers. The assessment is for action, not a binder ornament | Results leave the file. Not a report template. |
| Maintain | The assessment is revisited when systems, threats, missions, or environments change. One PDF is not forever | A register row does not close this step. |
CHECK THE CATEGORY
Which sentence matches SP 800-30 Rev. 1?
Glossary and nearby pages
- SP 800-37 explainer (RMF process, assessments inform it)
- SP 800-137 explainer (ISCM strategy and program, not this assessment)
- SP 800-53 explainer (control catalog)
- NIST SP 800-53 Reference card (catalog summary)
- FISMA explainer (statutory backdrop only)
- FedRAMP explainer (cloud Authorization, different object)
- Threat, vulnerability, likelihood, impact, and uncertainty (F2)
- One risk, one owner, one open question (R1)
- GRC evidence lab (evidence and exception habit, not an 800-30 package)
- GRC practice path
- Public sector industry path
- SP 800-39 on NIST CSRC (name only, no Atlas page)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.