What is NIST SP 800-30?
NIST SP 800-30 is the guideline from the US National Institute of Standards and Technology (NIST) that describes how you prepare, conduct, communicate and maintain an information security risk assessment. The current version is Revision 1, Guide for Conducting Risk Assessments, published in September 2012. The method determines risk as a combination of the likelihood that a threat event occurs and the impact it would have. It was written for US federal information systems, but is used worldwide in both IT and OT environments, including industrial networks.
🧠 What exactly is NIST SP 800-30?
SP 800-30 is a Special Publication: a guideline, not a certifiable standard. The first version appeared in July 2002 as Risk Management Guide for Information Technology Systems and covered risk assessment, risk mitigation and evaluation in one document. Revision 1, produced by the Joint Task Force Transformation Initiative of NIST and the US defence and intelligence communities, replaced it in September 2012 and focuses solely on assessing risk.
The other parts of risk management are covered by sister publications:
- SP 800-39 - risk management consists of four components: framing, assessing, responding to and monitoring risk; SP 800-30 elaborates only the assessment component
- NIST SP 800-37 - the seven-step NIST Risk Management Framework, in which SP 800-30 provides the risk analysis
- NIST SP 800-53 - the catalogue of security and privacy controls you select from once the risks are known
No new revision has been announced so far: Rev. 1 from 2012 remains the current version.
📚 How is NIST SP 800-30 structured?
The process consists of four steps with fifteen tasks in total. Appendix L of the publication summarises them.
| Step | Tasks | What you do |
|---|---|---|
| 1. Prepare | 1-1 to 1-5 | Define purpose, scope, assumptions and constraints, information sources, and the risk model and analytic approach |
| 2. Conduct | 2-1 to 2-6 | Identify threat sources, threat events and vulnerabilities, then determine likelihood, impact and risk |
| 3. Communicate | 3-1 and 3-2 | Share results with decision makers and distribute relevant risk information |
| 4. Maintain | 4-1 and 4-2 | Keep monitoring the risk factors and update the assessment |
A risk assessment can take place at three levels (tiers): the organisation (tier 1), the mission or business process (tier 2) and the information system (tier 3). For an OT installation you usually work at tier 3, but the outcome feeds risk decisions at the higher levels.
Appendices D to I are the practical core of the publication: example tables for threat sources (D), threat events (E), vulnerabilities and predisposing conditions (F), likelihood (G), impact (H) and risk determination (I). Appendix K provides a template for the risk assessment report.
🔍 Which risk factors does the model use?
SP 800-30 names five typical risk factors: threat, vulnerability, impact, likelihood and predisposing condition. A predisposing condition is a property of the organisation or system that increases the chance of harm, such as a flat network without segmentation or legacy operating systems that no longer receive patches.
Threat sources fall into four types:
- Adversarial - attackers such as criminals, competitors, suppliers or nation states, but also a malicious insider; assessed on capability, intent and targeting
- Accidental - errors by users or administrators in the course of their everyday work
- Structural - failures of equipment, software or environmental controls due to ageing or overload
- Environmental - natural disasters and failures of critical infrastructure outside your control, such as power or telecoms
The publication offers three assessment approaches (quantitative, qualitative and semi-quantitative) and three analysis approaches: threat-oriented, asset/impact-oriented or vulnerability-oriented. A threat-oriented analysis fits well with threat modelling and MITRE ATT&CK for ICS; an impact-oriented analysis aligns with a Business Impact Analysis.
📊 How does SP 800-30 determine the level of risk?
A common simplification is risk = likelihood × impact, but SP 800-30 does not prescribe a multiplication. Risk is a function of likelihood and impact, determined with lookup tables. Likelihood is itself a combination of two estimates: how likely a threat event is to be initiated or to occur, and how likely it is to then cause adverse impact.
The assessment scales in the appendices consistently use the same five levels, with one qualitative and two semi-quantitative variants:
| Qualitative | Semi-quantitative (0–100) | Scale 0–10 | Example frequency for a non-adversarial event |
|---|---|---|---|
| Very High | 96–100 | 10 | More than 100 times a year |
| High | 80–95 | 8 | 10 to 100 times a year |
| Moderate | 21–79 | 5 | 1 to 10 times a year |
| Low | 5–20 | 2 | Less than once a year, more than once every 10 years |
| Very Low | 0–4 | 0 | Less than once every 10 years |
The risk matrix in Table I-2 combines both axes. High likelihood with high impact gives High; moderate likelihood with very high impact also gives High; low likelihood with high impact results in Low. That last outcome is a known concern in OT: rare events with physical consequences can score too low this way.
🏭 How do you apply NIST SP 800-30 in OT?
SP 800-30 was written with information systems in mind, but its steps work well for ICS. The OT-specific guide NIST SP 800-82 (Rev. 3, September 2023) adds what is different in OT. A practical approach:
- Define the scope (task 1-2) - pick an installation or zone and record Assets in an asset inventory, from PLC to engineering workstation
- Adapt the impact scale (task 1-5) - add safety, environment and lost production to the impact categories; confidentiality often weighs least in OT
- Select threats (tasks 2-1 and 2-2) - use threat intelligence and Table E-2, which lists not only delivering malware but also cyber-physical attacks on facilities
- Collect vulnerabilities (task 2-3) - combine vulnerability management, CVSS scores and the Known Exploited Vulnerabilities catalogue with predisposing conditions such as missing segmentation
- Determine risk (tasks 2-4 to 2-6) - score each scenario with the matrix and record it in a risk register
- Communicate and maintain (steps 3 and 4) - discuss the outcome with management and repeat the assessment after changes, in line with the PDCA cycle
A simplified example using the SP 800-30 scales:
| Asset | Threat | Vulnerability | Likelihood | Impact | Risk |
|---|---|---|---|---|---|
| PLC | External attacker via remote access | No MFA, old firmware | Moderate | Very High | High |
| SCADA server | Ransomware via USB | No Application Control | High | High | High |
| Historian | DDoS attack | Unsecured API | Moderate | Moderate | Moderate |
| HMI | Unauthorised modification | No RBAC | High | High | High |
After the assessment you choose a response per risk: mitigating measures such as a firewall, access control or patch management, or accepting, sharing or avoiding the risk. Formally, that decision falls under SP 800-39, not SP 800-30.
🔗 How does NIST SP 800-30 relate to other frameworks?
| Standard / framework | Relationship to SP 800-30 |
|---|---|
| NIST CSF | Risk assessment falls under the Risk Assessment category (ID.RA) of the Identify function |
| NIST Risk Management Framework | Uses SP 800-30 for its risk assessments, including in the Prepare step |
| ISO 27005 | Comparable method within an ISMS based on ISO 27001; fourth edition from 2022 |
| ISO 31000 | Generic risk management standard; SP 800-30 is one concrete implementation of it |
| IEC 62443-3-2 | OT-specific: risk per zone and conduit, resulting in a target security level |
| FISMA | Requires US federal agencies to carry out periodic risk assessments; SP 800-30 is the associated guideline |
In the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026 as the Dutch implementation of NIS2, requires essential and important entities to take risk-based measures, including a policy on risk analysis. The act does not prescribe a method, so SP 800-30 is a well-founded, freely available choice alongside ISO 27005 or IEC 62443-3-2.
❓ Frequently asked questions
Is NIST SP 800-30 mandatory in the Netherlands?
No, NIST SP 800-30 is a US guideline and only the expected method for US federal agencies. Dutch organisations under the Cyberbeveiligingswet must carry out a risk analysis, but may choose the method themselves. NIST SP 800-30 is a widely used and defensible choice for that purpose.
Which version of NIST SP 800-30 is current?
The current version is NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments, from September 2012. It replaced the original version from July 2002. No Revision 2 has been announced so far.
What is the difference between NIST SP 800-30 and ISO 27005?
NIST SP 800-30 is a free US guideline that focuses only on assessing risk and comes with detailed example scales. ISO 27005 is an international standard that describes the full risk management process within an ISMS based on ISO 27001, including risk treatment. The two methods combine well.
Can NIST SP 800-30 be used for OT installations?
Yes, NIST SP 800-30 works for OT, provided you extend the impact scale with safety, environment and production. Combine the method with NIST SP 800-82 for OT-specific threats and with IEC 62443-3-2 if you work with zones and conduits.
Does NIST SP 800-30 have to be quantitative?
No, NIST SP 800-30 allows qualitative, semi-quantitative and quantitative assessments. Most organisations use the qualitative five-level scale from Very Low to Very High, or the semi-quantitative scale from 0 to 100.
What does a NIST SP 800-30 risk assessment deliver?
A risk assessment based on NIST SP 800-30 delivers a prioritised list of risks, each with its threat source, vulnerability, likelihood and impact. Appendix K provides a template for the report. Decision makers use that outcome to select controls and accept residual risks.
📌 In summary
NIST SP 800-30 Rev. 1 is the NIST guideline for risk assessment in four steps: prepare, conduct, communicate and maintain. The method determines risk from likelihood and impact using fixed five-level scales, and aligns with the NIST Risk Management Framework, NIST CSF and ISO 27005. With an impact scale that weighs safety and production, it is also a solid basis for Security and risk management in OT.