NIST 800-53 PM-28 Risk Framing: Write Down Your Assumptions

PM-28, Risk Framing, asks you to identify and document four things: the assumptions affecting risk assessments, responses and monitoring; the constraints on them; the priorities and trade offs the organization has considered; and the organization's risk tolerance. You then share the results with defined recipients and review them on a schedule you set.

800-53 binds federal systems and, by contract, others. For a private company it is a good reference for the document that sits above your risk register and explains why the register looks the way it does.

What it means in practice

The record says risk framing works best at the organization level, in consultation with people across the business: mission and business owners, system owners and others. Its output informs the risk management strategy (PM-9), and the strategy in turn informs risk assessment, risk response and risk monitoring.

That chain matters. Without framing, two teams can score the same risk differently and both be right, because they assumed different things. Written framing gives them a shared yardstick.

A short example. An assumption: customer data stays in two cloud regions. A constraint: the billing system cannot go offline in the last week of the month. A priority: uptime outranks feature speed for the payments path. A tolerance: a medium risk may be accepted for up to ninety days with an owner and a plan, and no high risk without executive sign off.

The record lists who should receive the results: owners, information stewards, system owners, authorizing officials, and the senior security, privacy and risk officials. In a small company that is the leadership team and the heads of engineering and operations.

Review matters because assumptions expire. A new regulation, a new market, a merger or a major incident can all invalidate what you wrote last year.

Evidence to collect

• A risk framing document listing assumptions, constraints, priorities, trade offs and tolerance
• Approval and date by a senior owner
• The distribution list and proof it was sent
• Review records and the changes made at each review
• Risk register entries that reference the framing, for example an acceptance rule based on tolerance

Common gaps

• Tolerance is described as "low" with no way to apply it
• The document exists but is not connected to how risks are scored
• Only security wrote it, so the business does not recognize it
• Assumptions were never revisited after a big change
• No record of who received it

How to implement it

• Workshop it with leadership. One or two hours is enough for a first version.
• Write each of the four elements as short, testable statements.
• Turn tolerance into rules: score thresholds, who may accept what, for how long.
• Link risk register scoring and acceptance to those rules.
• Send it to the defined recipients and keep the receipt.
• Review it yearly and after major events.

Quick check

Sources

• NIST SP 800-53 Rev 5, PM-28 Risk Framing
• NIST OSCAL catalog for SP 800-53 Rev 5