Risk Assessment (ID.RA) — NIST CSF 2.0 Category

Category outcome

NIST CSF 2.0 places Risk Assessment (ID.RA) within the Identify Function. The official Category outcome is: “The cybersecurity risk to the organization, assets, and individuals is understood by the organization.”

This Category provides a structured way to address vulnerabilities, threats, intelligence, likelihood, impact, inherent risk, response, change, authenticity, and supplier risk. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Risk Assessment capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

• Identify vulnerabilities, threats, exposures, and affected assets using multiple evidence sources.
• Estimate likelihood and impact using a consistent, documented method.
• Distinguish inherent risk, existing control effectiveness, and residual risk.
• Select, prioritize, track, and communicate risk responses and exceptions.
• Reassess when threats, vulnerabilities, suppliers, technology, or business conditions change.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

• Risk assessments and risk-register records
• Vulnerability, threat intelligence, and exposure data
• Likelihood, impact, and control-effectiveness rationale
• Risk response, exception, and change-review records
• Supplier and technology authenticity assessments

Subcategories within ID.RA

This Category contains 10 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

• ID.RA-01 — Identify and Record Vulnerabilities: Vulnerabilities in assets are identified, validated, and recorded
• ID.RA-02 — Receive Cyber Threat Intelligence: Cyber threat intelligence is received from information sharing forums and sources
• ID.RA-03 — Identify Internal and External Threats: Internal and external threats to the organization are identified and recorded
• ID.RA-04 — Estimate Threat Likelihood and Impact: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
• ID.RA-05 — Understand Inherent Risk: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
• ID.RA-06 — Select and Track Risk Responses: Risk responses are chosen, prioritized, planned, tracked, and communicated
• ID.RA-07 — Manage Changes and Exceptions: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
• ID.RA-08 — Vulnerability Disclosure Processes: Processes are established for receiving, analyzing, and responding to vulnerability disclosures
• ID.RA-09 — Assess Hardware and Software Authenticity: The authenticity and integrity of hardware and software are assessed prior to acquisition and use
• ID.RA-10 — Assess Critical Suppliers Before Acquisition: Critical suppliers are assessed prior to acquisition

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

• Risk scores are assigned without documented assumptions or evidence.
• Vulnerability severity is treated as equivalent to organizational risk.
• Changes and exceptions bypass reassessment.
• Risk responses are selected but not tracked to completion or effectiveness.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST Cybersecurity Framework (CSF) 2.0 — NIST CSWP 29
• NIST Cybersecurity Framework Resource Center
• NIST CSF 2.0 Reference Tool
• NIST CSF 2.0 Organizational Profiles