A lightweight risk assessment is a dated list of what could go wrong with your service, how likely and how damaging each item is, what you do about it, and who owns it. A small team can finish a first pass in a day. Buyers ask for it because it shows you decide security work on purpose.
Why buyers ask
Questionnaires often include "Do you perform a formal risk assessment at least annually?" The honest answer needs a document with a date, a method and decisions. "We think about risk all the time" does not count.
What NIST SP 800-30 offers
NIST SP 800-30 Revision 1, published in September 2012, is guidance for conducting risk assessments of federal information systems and organizations. Its keywords include threat, vulnerability, risk mitigation, residual risk and cost-benefit analysis. It is written for a federal setting and is long, so treat it as a reference for vocabulary, not a template to copy line by line. I confirmed the abstract and date from NIST's page, but not the step by step process, so read the full publication before citing its method.
A one day method
- Scope it. List the systems that touch customer data: product, database, cloud accounts, CI, support tools, identity provider.
- List threats. For each system, write plausible events, such as stolen credentials, a vulnerable dependency, a misconfigured storage bucket, a malicious insider, a vendor outage.
- Rate each. Use a plain scale of low, medium and high for likelihood and for impact. Write one sentence of reasoning for each rating.
- Choose a response. Reduce, accept, transfer or avoid. Record the decision.
- Assign an owner and a date. One person per item, with a review date.
- Record residual risk. What remains after your planned controls.
- Get sign off. A founder or senior leader reads and approves it, with the date.
A sample register row
| Risk | Likelihood | Impact | Response | Owner | Review |
|---|---|---|---|---|---|
| Stolen staff credentials lead to production access | Medium | High | Enforce MFA, short session lifetime, alerting | Head of engineering | Quarterly |
Keep to the top ten to fifteen risks. A short list that you act on beats a long list nobody reads.
What to share with a buyer
Most buyers do not need the full register. Offer a summary: the date of the last assessment, the method in a paragraph, the number of risks, and the top few with their treatments, under NDA if the details are sensitive. Do not claim an independent assessment unless a third party did one.
Keep it alive
Review the register when something material changes: a new vendor, a new data type, an incident, a large feature. Add a calendar reminder for the annual review. An assessment dated two years ago is worse than none, since it shows the process stopped.
Quick check
Do we need to follow NIST SP 800-30 exactly?
No. It is guidance written for federal systems. Use its ideas and vocabulary, and document the method you actually use.
How often should we repeat it?
At least annually and when something material changes, such as a major feature, a new data type or an incident.
Safeguard's compliance suite includes risk and evidence tracking features, and the free scan can feed your dependency risks into the register.
Sources
- NIST, SP 800-30 Rev. 1, Guide for Conducting Risk Assessments: purpose, keywords, September 2012 date. Paraphrased.
Last reviewed: 19 October 2026.
