Update your risk assessment on a regular schedule and whenever something material changes. NIST leaves the interval to each organization, saying organizations decide the frequency and circumstances for updates. A common pattern is a full review once a year, top risks quarterly, and event driven updates after major changes or incidents.
What NIST actually says
NIST SP 800-30 divides assessment into four steps: prepare, conduct, communicate, and maintain. The maintain step has two tasks: monitor the risk factors that drive change, and update the assessment using what monitoring finds. The guidance says organizations determine the frequency and the circumstances under which assessments are updated, and that the risk management strategy conveys which factors to monitor and how often.
So the standard does not give you a number. It asks you to choose one on purpose and write it down.
A cadence that works
- Whole register: review once a year, with a fresh look at scales and scope.
- Top risks: review each quarter. These are the ones leaders will ask about.
- Everything else: review at least annually, or when its owner reports a change.
- Accepted risks: review on the date set at acceptance.
If your environment changes quickly, shorten these. If it is stable, you can lengthen the long tail, but not the top of the list.
Triggers that should force an update
- A new product, service or major feature.
- A migration to a new platform or cloud provider.
- A merger, reorganization or major hire or departure in a key role.
- A security incident or near miss.
- A new vendor with access to sensitive data.
- A change in law or customer contract requirements.
- A new class of threat relevant to your assets.
- A control that fails a test or is retired.
Write the trigger list into your risk procedure so nobody has to guess.
Monitor the inputs, not just the calendar
Between reviews, watch the factors that move ratings: vulnerability data on your systems, incident trends, changes in exposure, and results of control tests. NIST notes that information from ongoing monitoring can be used to refresh assessments at whatever frequency is deemed appropriate. A short monthly check of a few indicators will catch more than a yearly workshop.
Keep a change log
Each time a rating changes, note what changed and why. An auditor or executive reading the history can see that the process is real. A register with identical ratings for two years suggests nobody looked.
Check your framework's wording
Compliance regimes may expect assessments at stated intervals or after significant changes. Read the current text of the ones that apply to you, since requirements differ and change.
Quick check
Is an annual assessment enough?
For many programs it is the minimum, not the whole answer. Add quarterly reviews of top risks and event driven updates.
Does every incident require a new assessment?
It requires a look at the related risk entries. Update ratings if the incident showed likelihood, impact or controls were different from what you assumed.
Sources
Last reviewed: 19 October 2026.
