Where risk assessment fits in the NIST RMF seven steps

Risk assessment is not a single step in the NIST Risk Management Framework. It supports several. The seven steps are Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, and assessment results inform control selection, the authorization decision and ongoing monitoring.

The seven steps in brief

NIST describes the RMF as follows:

1. Prepare: get the organization ready to manage security and privacy risk.
2. Categorize: classify the system and its information based on an impact analysis.
3. Select: choose the SP 800-53 controls to protect the system, based on risk assessments.
4. Implement: put the controls in place and document how.
5. Assess: determine whether controls are in place, operating as intended, and producing the desired results.
6. Authorize: a senior official makes a risk based decision to authorize operation.
7. Monitor: continuously monitor control implementation and system risk.

Where assessment shows up

• Prepare. You set the risk frame: scope, assumptions, tolerance and the method you will use. NIST SP 800-30 calls this preparation the first step of the assessment process.
• Categorize. The impact analysis here is an input to everything after it. Impact drives how strict the controls must be.
• Select. The framework says control choice is based on risk assessments. Weak points found here lead to stronger or additional controls.
• Assess. Control testing results reveal gaps. Those feed back into the risk picture and update likelihood estimates.
• Authorize. The decision maker reads the residual risk and decides whether it is acceptable. This is formal risk acceptance.
• Monitor. Ongoing monitoring supports refreshing assessments as conditions change.

The assessment process inside

NIST SP 800-30 describes a four step assessment process: prepare, conduct, communicate and maintain. Do not confuse these with the seven RMF steps. The assessment process is a smaller loop that you run inside several RMF steps.

What this means for non-federal teams

You do not need to adopt the RMF to borrow its logic. The pattern is useful anywhere:

• Decide scope and tolerance first.
• Classify what matters by impact.
• Choose controls based on the risk.
• Test the controls.
• Have a named person accept what remains.
• Keep watching.

Whether a particular framework or contract requires the RMF is a question for its own text. Check the source rather than assuming.

Common gaps

• Treating categorization as a form to file, not a driver of control choice.
• Running an assessment once at authorization and never refreshing it.
• Authorizing without a clear statement of residual risk.
• Skipping the preparation step, which leads to arguments about scales later.

Quick check

Sources

• NIST Risk Management Framework, About the RMF
• NIST SP 800-30 Rev. 1

Last reviewed: 19 October 2026.