Risk Assessment (RA) templates
Templates for the Risk Assessment (RA) family of controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, with the family policy and procedure first.
- Risk Assessment PolicyPOL-RA
In this policy, the CISO sets the Organization's requirements for risk assessment in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Risk Assessment ProcedurePROC-RA
The people named in this procedure use it to carry out the RA control family policy (POL-RA). It covers every control in the risk assessment family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev.
- Vulnerability Disclosure PolicyPOL-VDP-001
- Vulnerability Management PolicyPOL-VM-001
- Vulnerability Management ProcedurePROC-VM-001
Use this procedure to find vulnerabilities, set a due date for each one, fix or isolate it, confirm the fix, and report to CISA.
- Risk Assessment and FIPS 199 CategorizationTMPL-RA-001