#
Risk Assessment Frameworks
#
Appendix: Cybersecurity Risk Assessment Frameworks and Methods
This appendix summarizes several respected cybersecurity risk assessment frameworks, methods, and supporting models. These resources can help organizations structure risk assessments, evaluate control gaps, prioritize remediation, and communicate cyber risk to leadership.
No single framework is perfect for every organization. For small and medium-sized enterprises, the best approach is usually to use one practical method as the primary assessment model, then borrow supporting concepts from others where useful.
#
1. CIS RAM
CIS RAM, the Center for Internet Security Risk Assessment Method, is designed to help organizations assess cybersecurity risk in relation to the CIS Critical Security Controls. It is especially useful for organizations that want a practical, control-based way to evaluate risk and determine whether existing safeguards are reasonable and appropriate.
CIS RAM is a strong choice for SMEs because it connects risk assessment directly to security controls that organizations can implement. It also supports different maturity levels through CIS Implementation Groups: IG1, IG2, and IG3. (Hint, SMEs start with IG1)
Best used for:
- SMEs
- CIS Controls alignment
- Practical control-based risk assessments
- Reasonable security analysis
- Prioritizing safeguards
Recommendation: CIS RAM is one of the best default options for SMEs because it is practical, structured, and directly tied to actionable cybersecurity controls.
#
2. NIST SP 800-30
NIST SP 800-30: Guide for Conducting Risk Assessments is one of the most respected formal cybersecurity risk assessment guides. It provides a structured process for identifying threats, vulnerabilities, likelihood, impact, and risk response.
This framework is widely used by government agencies, contractors, regulated industries, and mature security programs. It is especially useful when an organization needs a defensible and well-documented risk assessment process.
Best used for:
- Formal risk assessments
- Government contractors
- Regulated organizations
- Executive risk reporting
- Structured likelihood-impact analysis
Recommendation: NIST SP 800-30 is a strong backbone for the risk assessment process, but SMEs may need to simplify the documentation and scoring approach.
#
3. NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework 2.0 is a broader cybersecurity risk management framework rather than a dedicated risk assessment method. It organizes cybersecurity work around major functions: Govern, Identify, Protect, Detect, Respond, and Recover.
NIST CSF is highly useful for building the overall structure of a cybersecurity program. It helps organizations organize priorities, assess maturity, identify gaps, and communicate cybersecurity risk in a way that executives can understand.
Best used for:
- Cybersecurity program structure
- Executive reporting
- Maturity assessment
- Gap analysis
- Aligning cybersecurity work to business risk
Recommendation: NIST CSF is excellent for structuring the playbook itself, but it should be paired with a risk assessment method such as CIS RAM, NIST SP 800-30, ISO/IEC 27005, or FAIR for detailed scoring.
#
4. ISO/IEC 27005
ISO/IEC 27005 is regarded as a international standard for information security risk management. It supports organizations implementing or maintaining an information security management system under ISO/IEC 27001.
ISO/IEC 27005 is respected globally and is especially relevant for organizations that need ISO 27001 alignment, formal risk treatment planning, or internationally recognized security governance.
Best used for:
- ISO 27001 alignment
- Information security management systems
- International organizations
- Supplier assurance
- Formal risk treatment planning
Recommendation: ISO/IEC 27005 is best when the organization already follows ISO standards or needs to demonstrate risk management maturity to enterprise customers, auditors, or regulators.
#
5. FAIR
FAIR, which stands for Factor Analysis of Information Risk, is a quantitative cyber risk model. Unlike simple high-medium-low scoring, FAIR is designed to estimate cyber risk in financial terms.
FAIR breaks risk into measurable factors such as threat event frequency, vulnerability, loss event frequency, and probable loss magnitude. It is especially useful when leadership needs to understand cyber risk in financial language.
Best used for:
- Financial cyber risk quantification
- Board reporting
- Cyber insurance discussions
- Budget justification
- Comparing the business value of different security investments
Recommendation: FAIR is powerful, but it requires more analytical maturity than most SMEs have at the beginning. It is best used for major risks where financial quantification matters, not as the first framework for every small business.
#
6. OCTAVE Allegro
OCTAVE Allegro is an information asset-focused risk assessment method developed by Carnegie Mellon’s Software Engineering Institute.
It focuses on identifying important information assets, understanding how they are used, identifying threat scenarios, and evaluating the consequences of compromise. It is particularly useful for workshop-style assessments involving business and technical stakeholders.
Best used for:
- Information asset risk analysis
- Business process workshops
- Non-technical risk discussions
- Organizations that want an asset-centric assessment method
Recommendation: OCTAVE Allegro is useful for structured interviews and workshops, but it is less common in modern SME cybersecurity programs than CIS, NIST, ISO, or FAIR.
#
7. NIST Risk Management Framework
The NIST Risk Management Framework is a lifecycle framework for managing system-level risk. It includes steps such as categorizing systems, selecting controls, implementing controls, assessing controls, authorizing systems, and continuously monitoring risk.
It is more comprehensive and formal than a basic risk assessment method. It is commonly used in government, defense, and highly regulated environments.
Best used for:
- Federal systems
- Government contractors
- Regulated environments
- Formal system authorization
- Continuous control monitoring
Recommendation: NIST RMF is too heavy for most ordinary SMEs unless they have government, defense, healthcare, financial, or compliance-driven requirements.
#
8. ISO 31000 and IEC 31010
ISO 31000 is a general enterprise risk management standard. IEC 31010 provides risk assessment techniques that can be used across many risk domains.
These are not cybersecurity-specific, but they are useful for aligning cybersecurity risk with broader business risk management. They can help executives understand that cyber risk should be treated as part of enterprise risk, not as an isolated IT issue.
Best used for:
- Enterprise risk management
- Board-level risk governance
- Risk committees
- Business-wide risk methodology
- Aligning cyber risk with operational, financial, legal, and strategic risk
Recommendation: ISO 31000 is useful for executive language and governance alignment, but it needs a cybersecurity-specific method underneath it.
#
9. COBIT and Risk IT
COBIT is an IT governance framework from ISACA. It helps organizations connect technology governance, control ownership, performance objectives, and business goals. ISACA’s Risk IT Framework provides additional structure for IT risk governance and management.
These frameworks are useful when cyber risk needs to be connected to IT governance, audit, accountability, and enterprise objectives.
Best used for:
- IT governance
- Audit-heavy organizations
- CIO/CISO reporting
- IT risk committees
- Control ownership
- Enterprise technology governance.
Recommendation: COBIT is useful for governance alignment, but it is not usually the simplest operational risk assessment method for SMEs.
#
10. EBIOS Risk Manager
EBIOS Risk Manager is a cybersecurity risk assessment method developed by France’s national cybersecurity agency, ANSSI. It is scenario-driven and focuses on business values, threat sources, attack paths, and strategic cyber risk.
EBIOS is particularly useful for organizations that want to model realistic attack scenarios and understand how threat actors could target critical assets or business functions.
Best used for:
- European organizations
- Regulated entities
- Critical infrastructure
- Advanced scenario analysis
- Threat-driven risk assessments.
Recommendation: EBIOS Risk Manager is powerful, but it may be more complex than necessary for a small company conducting its first cybersecurity risk assessment.
#
11. ISF IRAM2
ISF IRAM2 is the Information Security Forum’s information risk assessment methodology. It is used mainly by larger organizations and mature security programs.
IRAM2 focuses on business-driven information risk assessment and helps organizations evaluate threats, vulnerabilities, impacts, and control effectiveness.
Best used for:
- Mature enterprise programs
- Large organizations
- Information risk management
- Organizations already involved with the Information Security Forum.
Recommendation: ISF IRAM2 is respected, but it is usually less accessible for ordinary SMEs because it is more enterprise-oriented.
#
12. IEC 62443
IEC 62443 is a major cybersecurity standard series for industrial automation and operational technology environments.
It is not a general office cybersecurity risk framework. It becomes important when an organization operates manufacturing systems, industrial control systems, production equipment, energy systems, building systems, or other operational technology.
Best used for:
- Manufacturing
- Industrial control systems (ICS)
- Operational technology
- Critical infrastructure, energy, utilities, logistics, and production environments
Recommendation: IEC 62443 should be included when OT or industrial systems are in scope. For an office-only SME, it is usually unnecessary.
#
Practical Recommendation for SMEs
For most small and medium-sized organizations, a practical hierarchy is:
Use NIST Cybersecurity Framework 2.0 to structure the overall cybersecurity program.
Use CIS RAM as the default SME-friendly risk assessment method.
Use NIST SP 800-30 as the formal reference for conducting risk assessments.
Use ISO/IEC 27005 when ISO 27001 alignment matters.
Use FAIR when financial quantification of cyber risk is needed.
Use IEC 62443 only when operational technology or industrial systems are in scope.