Source: NIST SP 800-30 R1

According to NIST SP 800-30 R1, risk assessment is the process of identifying, estimating, and prioritizing information security risks. This definition matches the one in ISO 31000; estimating refers to the analysis, while prioritizing refers to evaluation.

However, the guideline uses two terms in the risk assessment process that may confuse people: assessment approach and analysis approach.

• Assessment approach: e.g., quantitative, qualitative, or semi-qualitative
• Analysis approach: e.g., threat-oriented, asset/impact-oriented, or vulnerability-oriented

Risk Framing Components

The assessment approach defined in the Frame stage should apply to the “risk assessment process” as a whole, while the analysis approach should refer to the approach used to “estimate” risk as a part of the risk assessment process.

FIGURE 2: RELATIONSHIP AMONG RISK FRAMING COMPONENTS (NIST SP 800-30 R1)

FIGURE 5: RISK ASSESSMENT PROCESS (NIST SP 800-30 R1)

Risk Assessment “Slash” Analysis?

It seems that both ISO and NIST distinguish risk assessment from risk analysis. However, it’s common for people to use them interchangeably. I think it’s a good practice to use them precisely.