What it covers. NIST guidance on conducting information security risk assessments. It describes the risk assessment process of preparing, conducting, communicating and maintaining assessments, with risk models built on threat sources, threat events, vulnerabilities, likelihood and impact.
In practice. Applying it well means defining the purpose, scope, assumptions and model before starting, identifying relevant threats and vulnerabilities, and estimating likelihood and impact consistently. Results are communicated to decision makers and maintained over time as conditions change. Evidence includes the assessment method, completed assessments, risk registers and records of decisions.
Common gaps. Typical gaps are inconsistent scoring between assessors, assessments done once for compliance and never updated, and results that do not feed decisions. Likelihood estimates are also often made without reference to threat information.