Why 'Risk Assessment' Sounds So Difficult
A health checkup report doesn't say 'you're healthy' — it lists numbers and grades. Risk assessment works the same way. Here's how NIST SP 800-30 and ISO 27005 turn risk into numbers. Part 2 of the RMF·NIS2 series.
A few days after a health checkup, a sheet of paper arrives. It doesn’t say “you are healthy.” Instead it’s a long list of numbers. Fasting blood glucose, this much. Cholesterol, that much. Next to each one sits a grade like Normal · Caution · Abnormal.
At first it’s frustrating. You want to know whether you’re sick or not, and the paper just hands you numbers. But this sheet is far more useful than a one-line “you are healthy.” The numbers can be compared against last year’s, and the grades tell you what to fix first.
That’s exactly why “risk assessment” sounds so difficult. We think of security as two boxes — safe / dangerous — but risk assessment speaks in figures and grades, like a checkup report.
Not Two Boxes, but a Grid
FACT NIST SP 800-30 is a risk assessment methodology produced by the U.S. standards body. The core of it fits in one line. It quantifies risk by crossing likelihood with impact. “Quantify” sounds difficult, but it means assigning numbers and grades.
Likelihood is “how probable is it that this actually happens.” Impact is “how much does it hurt if it does.” In checkup terms, likelihood is conditions like age and family history, and impact is what happens to your body when that number goes bad.
FACT Each axis has five levels. Very Low · Low · Moderate · High · Very High. The vertical axis is likelihood, the horizontal axis is impact, and the cell where the two axes meet is the risk grade. Table I-2 in the appendix of NIST SP 800-30 is this table, and SecurityHero RMF uses it as is.
Go through the cells one at a time and something becomes visible. Only the upper-right corner is red. No matter how high the likelihood, if impact is low it stays in the green on the left; no matter how large the impact, if likelihood is low it stays in the green at the bottom. Both have to be high for it to turn red.
Something that happens often but is no big deal, and something that almost never happens but shakes the company when it does, sit in different cells. Two-box thinking can’t see that difference.
Why Use a Scale Someone Else Made
FACT ISO 27005 is an information security risk management standard produced by the International Organization for Standardization. RMF uses both methodologies — NIST SP 800-30 and ISO 27005 — together.
Think about the checkup report and the reason is obvious. If every hospital assigned “Caution” by its own criteria, that sheet would only mean something inside that hospital. The scale has to be shared for another hospital, or an insurer, to read it.
FACT As we saw in Part 1, NIS2 Article 21 requires risk management measures to be documented and demonstrated in an audit. The people reading that document are not people from our company. They are the security officers of EU customers, auditors, and supervisory authorities.
| Health checkup report | Risk assessment report |
|---|---|
| Blood pressure, blood glucose figures | Findings per check item |
| Normal · Caution · Abnormal | Risk grade |
| Age · family history | Likelihood |
| What happens if it gets worse | Impact |
| The same scale at any hospital | NIST SP 800-30 · ISO 27005 |
So What Does RMF Actually Do
FACT SecurityHero RMF takes the results of checking AWS assets, IAM, and networks with Prowler, and combines them with EPSS and the NIST SP 800-30 / ISO 27005 methodologies to quantify risk grades. EPSS is an indicator that scores how likely a given vulnerability is to actually be exploited. It goes into the vertical axis of the table above — that is, it fills in “likelihood” with data instead of gut feel.
The EPSS story gets proper treatment in the next part. It’s the problem of what to tackle first when there are thousands of things to fix.
INFERRED We think the reason risk assessment feels burdensome in practice isn’t that the methodology is hard. It’s that a person has to gather the data to fill the grid by hand. A checkup report also requires drawing blood. If the blood draw is automatic, all that’s left is reading the results.
Things to Note
- This post is not legal advice. Whether our company falls under NIS2, and what risk grade a supervisory authority would consider sufficient, cannot be answered here. That is for legal professionals to judge.
- The table above is only a scale, not the entire assessment procedure. For the process of deciding what counts as likelihood and what counts as impact, you have to look at the NIST SP 800-30 and ISO 27005 documents themselves.
- An RMF report is not a certificate. It is supporting evidence used for submission and review. It does not include certificate issuance, incident reporting (NIS2 Article 23 and the like), or legal representation.
Series Contents
- Why You Have to Submit Security Paperwork to Sell in the EU
- Why ‘Risk Assessment’ Sounds So Difficult ← this post
- Three Thousand Things to Fix — Where Do You Start
- How Do You Run Checks Without Installing Anything
- What “Your Data Does Not Cross Borders” Actually Means
- Facing Multiple Countries with a Single Document