Risk Assessment Methodology
How leading risk frameworks differ, where they overlap, and how to choose one that survives contact with reality
Why Methodology Choice Matters
Methodology determines how consistently an organisation identifies, analyses, and communicates risk. It affects governance quality, audit defensibility, and how well technical findings translate into business decisions. Different methods optimise for different outcomes: policy alignment, compliance traceability, operational execution, or financial decision support.
Before selecting a method, start with the basics on /learn/risk. This page assumes you already understand core concepts such as threat, vulnerability, impact, and residual risk.
ISO 31000 — The Governance Wrapper
ISO 31000 is a general risk management standard, not cyber-specific guidance. Its value is structural: it defines principles, a governance framework, and a process model that can be applied across strategic, operational, financial, and security risk domains.
In cybersecurity programs, ISO 31000 often acts as the top-level governance wrapper so security risk decisions align with enterprise risk language and board reporting. Reference: https://www.iso.org/iso-31000-risk-management.html.
NIST SP 800-30 Rev. 1 — Risk Assessment Mechanics
NIST SP 800-30 Rev. 1 is a focused information security risk assessment guide. It defines a four-step flow: prepare for assessment, conduct assessment, communicate results, and maintain assessment over time.
The conduct step explicitly analyses threat sources, threat events, vulnerabilities, predisposing conditions, likelihood, and impact. SP 800-30 provides analytic depth that supports repeatable assessor practice and feeds directly into NIST RMF workflows. Reference: https://csrc.nist.gov/pubs/sp/800/30/r1/final.
NIST RMF (SP 800-37) — From Categorise to Continuous Monitoring
NIST SP 800-37 Rev. 2 defines the Risk Management Framework lifecycle: prepare, categorize, select, implement, assess, authorize, and monitor. It links system impact categorization to control selection, validation, formal risk acceptance, and ongoing oversight.
RMF parallels the ISM lifecycle in important ways: both are governance-heavy, authorization-centric, and built for continuous assurance rather than one-off assessment. SP 800-30 typically provides the assessment detail inside RMF execution. Reference: https://csrc.nist.gov/pubs/sp/800/37/r2/final.
ISM Risk Management — Classification, SSPs, and Risk Acceptance
The Australian Information Security Manual integrates risk management directly into system authorisation. Security classifications influence control expectations and shape acceptable residual risk based on organisational risk appetite.
In practice, System Security Plans document system context, controls, and treatment decisions, while Authorising Officers accept residual risk for operation. This creates traceability between technical state and governance accountability. Reference: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism. See also /learn/frameworks/ism and /learn/frameworks/ism/irap.
FAIR — Frequency x Magnitude in Financial Terms
FAIR (Factor Analysis of Information Risk) is a quantitative model that decomposes risk into Loss Event Frequency and Loss Magnitude. This supports range-based estimates, sensitivity analysis, and investment comparisons framed in financial terms.
FAIR is especially useful for strategic decisions such as control investment trade-offs, cyber insurance analysis, and board-level prioritisation where qualitative labels alone are insufficient. For rapid triage across large portfolios, qualitative methods may remain more practical. Reference: https://www.fairinstitute.org/.
Strengths, Weaknesses, and When to Use What
ISO 31000 is strongest for enterprise governance alignment but intentionally high-level for cyber-specific analysis. NIST SP 800-30 is strong in assessment depth but depends on broader governance structures for lifecycle execution. NIST RMF provides robust end-to-end governance and authorization traceability, though it can be process-heavy for low-maturity teams. ISM is highly actionable in Australian regulatory contexts, especially where classification and formal authorization are central. FAIR provides decision-grade quantification but requires strong data quality and modelling discipline.
These frameworks are complementary, not mutually exclusive. Choose based on organisational maturity, regulatory obligations, and decision type: compliance assurance, operational prioritisation, or financial optimisation. Hybrid models are common and often preferable.
How link42 Combines These Methods
link42 applies ISO-style governance structure, NIST-style assessment detail, ISM-compatible authorization thinking, and FAIR-inspired quantitative reasoning where needed. The goal is to support both defensible compliance reporting and practical prioritisation.
Threat context from /learn/threat and exposure context from /learn/vulnerability are combined with business context to produce explainable risk recommendations. AI-assisted risk assessment workflows are coming soon at link42.app.
Continue Learning
- Risk Assessment Overview — Revisit the core model before selecting a formal methodology.
- ISM Framework — Explore Australian government control and risk governance detail.
- IRAP Assessment Process — Understand independent assessment and authorisation support.
- Threat Intelligence — Improve likelihood analysis with adversary context.
- Vulnerability Management — Connect technical exposure to treatment priorities.