Risk Assessment Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for risk assessment in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers risk assessment and vulnerability management, and the Organization accepts by default any risk it does not examine. The Organization must categorize every system under Federal Information Processing Standards (FIPS) 199 and must assess risk under NIST SP 800-30, on schedule and after any significant change, using current threat information. It must scan for vulnerabilities continuously with authenticated coverage. It must remediate vulnerabilities in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog within the timelines in Binding Operational Directive (BOD) 26-04, which consolidates federal vulnerability remediation requirements. Those timelines include the 15-day critical and 30-day high deadlines for internet-facing systems. It must identify High Value Assets, because that designation brings OMB M-19-03 obligations.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.RM — Risk Management Strategy (Govern function)
• GV.OV — Oversight (Govern function)
• ID.AM — Asset Management (Identify function)
• ID.RA — Risk Assessment (Identify function)
• ID.IM — Improvements (Identify function)
• DE.CM — Continuous Monitoring (Detect function)

These categories fall under the Detect, Govern, Identify function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every risk assessment control in the low baseline of FIPS 200 and NIST SP 800-53B:

• RA-01 — Policy and Procedures
• RA-02 — Security Categorization
• RA-03 — Risk Assessment
• RA-03(1) — Supply Chain Risk Assessment
• RA-05 — Vulnerability Monitoring and Scanning
• RA-05(11) — Public Disclosure Program
• RA-05(2) — Update Vulnerabilities to Be Scanned
• RA-07 — Risk Response
• RA-08 — Privacy Impact Assessments

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• OMB M-20-32: Improving Vulnerability Identification, Management, and Remediation, October 28, 2020.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the RA control family. They add to the NIST SP 800-53 control requirements in the Policy section.

NIST SP 800-30: Guide for Conducting Risk Assessments

• The organization must ensure risk assessments evaluate threats, vulnerabilities, impact to missions and business operations, and the likelihood of threat exploitation. Assessments must be conducted at all three tiers: organization, mission/business process, and information system. (NIST SP 800-30r1, §2)
• The organization must ensure risk assessments are updated periodically and whenever significant changes occur. The assessment must produce a risk report that identifies risk levels, prioritized risks, and recommended mitigations. Deadline: Periodically + on significant change. (NIST SP 800-30r1, §3)

NIST SP 800-39: Managing Information Security Risk

• The organization must manage information security risk at three tiers: Tier 1 (organization), Tier 2 (mission/business process), and Tier 3 (information system). Risk management must be integrated into all levels of the organization. (NIST SP 800-39, §2)

OMB M-19-03: Management of High Value Assets

• The organization must identify, inventory, and prioritize High Value Assets (HVAs) — systems that hold sensitive data or support critical missions. HVAs require enhanced security controls, more frequent assessments, and prioritized remediation. (OMB M-19-03, §1)
• The organization must identify, categorize, and prioritize High Value Assets (HVAs) using the OMB-defined categories (informational value, mission essential, federal civilian enterprise essential), and maintain the HVA inventory with annual review and submission to DHS/CISA. (OMB M-19-03, §A)

FedRAMP CR26: FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators)

• The organization should review the vulnerability reports from each FedRAMP authorized provider at intervals that match the system’s authorization, using automated processing of the provider’s machine-readable data. (FedRAMP Consolidated Rules for 2026, VER-AGM-RVR)
• The organization should use the provider’s vulnerability reports to keep the Organization’s own POA&M items when the Organization mitigates a provider vulnerability or accepts continued use with one. (FedRAMP Consolidated Rules for 2026, VER-AGM-MAP)

3. Policy #

The Organization must implement and maintain its risk assessment controls to meet the following requirements:

RA-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy / HVA overlay CSF 2.0: GV.RM (Risk Management Strategy), ID.RA (Risk Assessment)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] risk assessment policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
3. Review and update the current risk assessment:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a risk assessment policy at the organization level and the system level, with the procedures that put it into practice. The policy must fix its purpose and scope, assign roles, record management’s commitment, and set expectations for coordination and compliance in how the Organization identifies and weighs risk. It must stay consistent with the multi-tier risk management approach in NIST SP 800-39. The CISO must manage the development, documentation, and distribution of both documents and deliver each approved version to the Authorizing Official (AO), System Owners, Information System Security Officers (ISSOs), and key stakeholders. The CISO must review and update the policy and the procedures every year. The CISO must also review them sooner after a change in mission, business processes, information technologies, system architectures, or the threat environment.

RA-02 — Security Categorization #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), ID.RA (Risk Assessment)

Requirement:

1. Categorize the system and information it processes, stores, and transmits;
2. Document the security categorization results, including supporting rationale, in the security plan for the system; and
3. Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

Implementation guidance:

System Owners must categorize each system and the information it processes, stores, and transmits under FIPS 199. System Owners must use the information types in NIST SP 800-60. The highest impact level for confidentiality, integrity, or availability across all information types sets the system’s category. That category sets the control baseline, as FIPS 200 directs. System Owners must document the categorization and its rationale in the System Security and Privacy Plan (SSPP). The AO, or the AO’s designated representative, must approve each categorization before anyone relies on it for control selection or authorization. System Owners must revisit the categorization when the system’s information types, mission use, or architecture change. The categorization must also inform the Organization’s identification of High Value Assets under OMB M-19-03.

RA-03 — Risk Assessment #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.RA (Risk Assessment), ID.IM (Improvements)

Requirement:

1. Conduct a risk assessment, including:

1. Identifying threats to and vulnerabilities in the system;
2. Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
3. Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

2. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
3. Document risk assessment results in security assessment report;
4. Review risk assessment results at least every three (3) years and when a significant change occurs;
5. Disseminate risk assessment results to [Assignment: organization-defined personnel or roles — to be defined]; and
6. Update the risk assessment at least every three (3) years or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Implementation guidance:

For every system, the System Owner must make sure a risk assessment takes place. The assessment identifies threats and vulnerabilities and determines how likely harm to the system and its information is and how severe it would be. It also determines the likelihood and impact of adverse effects on individuals from the processing of personally identifiable information (PII). The System Owner must coordinate that privacy analysis with the Senior Agency Official for Privacy (SAOP). Under NIST SP 800-30r1, the Organization must integrate system-level results with risk decisions at the organization tier and the mission and business process tier. The System Owner must document the results in the Risk Assessment Report. The System Owner must review the results every year or whenever a significant change to the system occurs, and distribute them at a minimum to the AO, System Owner, and ISSO. The System Owner must update the assessment every year as part of continuous monitoring and ongoing authorization. The System Owner must also update it whenever a change to the system, its environment, or other conditions alters its security or privacy posture.

RA-03(1) — Supply Chain Risk Assessment #

Baselines: Low / Moderate / High

Requirement:

1. Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services — to be defined]; and
2. Update the supply chain risk assessment [Assignment: organization-defined frequency — to be defined], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

Implementation guidance:

The Organization must assess the supply chain risks of its systems, system services, system components, and software. This applies to those that support Mission Essential functions or Primary Mission Essential functions, and to those designated High Value Assets. The CISO team must assess them with the affected System Owners. The CISO team must update each assessment [RA-03(1) parameter 2 — to be defined]. It must also update the assessment when the relevant supply chain changes significantly, and when a change to the system or its environment alters what the supply chain can reach.

RA-05 — Vulnerability Monitoring and Scanning #

Baselines: Low / Moderate / High / HVA overlay CSF 2.0: ID.AM (Asset Management), ID.RA (Risk Assessment), DE.CM (Continuous Monitoring)

Requirement:

1. Monitor and scan for vulnerabilities in the system and hosted applications monthly operating system/infrastructure; monthly web applications (including APIs) and databases and when new vulnerabilities potentially affecting the system are identified and reported;
2. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:

1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;

3. Analyze vulnerability scan reports and results from vulnerability monitoring;
4. Remediate legitimate vulnerabilities high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery in accordance with an organizational assessment of risk;
5. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles — to be defined] to help eliminate similar vulnerabilities in other systems; and
6. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.

Implementation guidance:

The Organization must detect vulnerabilities continuously. Scanner agents report on managed endpoints and servers as changes occur, and authenticated vulnerability scans cover every asset without an agent: operating systems and databases every month, web applications every month. The Organization must also scan when someone reports a new vulnerability that could affect its systems. Detection content must be no more than 24 hours behind the vendor’s latest release. Before a system or component is exposed to the internet, the vulnerability management team must scan it. The CISO must not allow the exposure while a critical finding, or a high finding past its due date, remains open. ISSOs must analyze the findings for their systems. Owning administrators must fix each legitimate finding by its due date. The due date is the earliest of the CISA BOD 26-04 Table 1 timeline, the Organization’s timeframe for its severity (critical 30 days, high 30, moderate 60), and any CISA directive deadline. The ISSO must share critical and high findings with the Security Operations Center as soon as they are identified. Results must reach the AO, System Owners, and ISSOs so a weakness fixed on one system is checked on the rest. The Vulnerability Management Procedure sets the steps.

RA-05(2) — Update Vulnerabilities to Be Scanned #

Baselines: Low / Moderate / High

Requirement:

Update the system vulnerabilities to be scanned prior to a new scan.

Implementation guidance:

The Organization must update the vulnerability content that the vulnerability scanner scans against before each scan and whenever a new vulnerability is identified and reported. The System/Application Administrators responsible for the scanning platform must verify that the content is current as part of every scan cycle. The ISSO must treat a scan run on stale content as no scan at all. The administrators must repeat the cycle once the content is current.

RA-05(11) — Public Disclosure Program #

Baselines: Low / Moderate / High

Requirement:

Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.

Implementation guidance:

The Organization must operate a public, discoverable channel through which outside parties can report vulnerabilities in its systems and components. The CISO owns the channel. The CISO must make sure the published terms plainly authorize good-faith research and reporting. The terms must not demand that reporters stay silent indefinitely, though the Organization may ask for a reasonable period to remediate before disclosure. Every report received must enter the Organization’s vulnerability handling process.

RA-07 — Risk Response #

Baselines: Low / Moderate / High / Privacy CSF 2.0: GV.RM (Risk Management Strategy), GV.OV (Oversight), ID.RA (Risk Assessment), ID.IM (Improvements)

Requirement:

Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

Implementation guidance:

Every finding from a security or privacy assessment, from monitoring, or from an audit must receive a deliberate response within the Organization’s risk tolerance. The response is one of four: mitigate the finding, accept it with a documented justification, transfer the risk, or avoid it. System Owners must propose the response for findings on their systems. The AO owns risk acceptance; a risk is not accepted until the AO documents the decision. The Risk Management Strategy (PLAN-RMS-001) sets which official may accept each level of risk and who must concur. When the System Owner chooses mitigation but cannot complete it immediately, the ISSO must create a plan of action and milestones (POA&M) item with milestones and track it to closure. The CISO must monitor response decisions and their execution across systems so the Organization’s total exposure reflects deliberate choices.

RA-08 — Privacy Impact Assessments #

Baselines: Privacy CSF 2.0: ID.RA (Risk Assessment)

Requirement:

Conduct privacy impact assessments for systems, programs, or other activities before: a. Developing or procuring information technology that processes personally identifiable information; and b. Initiating a new collection of personally identifiable information that: 1. Will be processed using information technology; and 2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Implementation guidance:

System Owners must complete a privacy threshold analysis before they develop or buy information technology that will handle personally identifiable information (PII), and before they start a new collection of PII. If the analysis shows that the system or collection handles PII, the System Owner must complete a privacy impact assessment (PIA) before work continues. The Organization requires a PIA for a new collection that uses information technology and gathers contact details from ten or more members of the public. The Senior Agency Official for Privacy (SAOP) must approve each PIA. The Authorizing Official must not grant an authorization until the SAOP has approved the PIA and agreed to the remaining privacy risk.

System Owners must update the PIA whenever a change to the system, its data, or its business practices changes the privacy risk. This follows the NIST SP 800-30 rule that risk assessments are updated when significant changes occur.

Related Required Processes #

• When the Organization has High Value Assets, the High Value Assets section of the Planning policy sets the inventory and category review, and the Planning procedure lists the steps.
• The privacy impact assessment (RA-08) starts from a privacy threshold analysis, and the SAOP approves it before the authorization decision. The steps are in the Personally Identifiable Information Processing and Transparency procedure.
• Security categorization (RA-02) is Risk Management Framework (RMF) tasks C-2 and C-3, and the system risk assessment (RA-03) is task P-14. The Assessment, Authorization, and Monitoring procedure lists every RMF task and who does it.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of risk assessment controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves risk assessment through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Correlate vulnerability, threat intelligence, and asset criticality into risk-based remediation prioritization (beyond Common Vulnerability Scoring System (CVSS) alone).
6. Automate KEV reconciliation so new catalog entries are matched to the environment within 24 hours.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• FIPS 199: Standards for Security Categorization, February 2004.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, September 2012.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-60 Rev. 1: Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.
• OMB M-20-32: Improving Vulnerability Identification, Management, and Remediation, October 28, 2020.