[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-30":3},{"item":4,"lessons":16,"controls":62,"related":89},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-30","SP 800-30","SP 800-30 Rev. 1: Guide for Conducting Risk Assessments",11,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on conducting information security risk assessments. It describes the risk assessment process of preparing, conducting, communicating and maintaining assessments, with risk models built on threat sources, threat events, vulnerabilities, likelihood and impact.\n\n**In practice.** Applying it well means defining the purpose, scope, assumptions and model before starting, identifying relevant threats and vulnerabilities, and estimating likelihood and impact consistently. Results are communicated to decision makers and maintained over time as conditions change. Evidence includes the assessment method, completed assessments, risk registers and records of decisions.\n\n**Common gaps.** Typical gaps are inconsistent scoring between assessors, assessments done once for compliance and never updated, and results that do not feed decisions. Likelihood estimates are also often made without reference to threat information.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F30\u002Fr1\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58],{"slug":19,"title":20,"published_at":21},"ai-worms-a-new-self-replicating-threat-on-the-horizon","AI Worms: A New Self-Replicating Threat on the Horizon","2026-10-13T22:21:28.999+00:00",{"slug":23,"title":24,"published_at":25},"cisos-cant-answer-boards-top-security-questions-due-to-data-silos-and-activity-focused-metrics","CISOs Can't Answer Board's Top Security Questions Due to Data Silos and Activity-Focused Metrics","2026-10-02T12:20:36.166+00:00",{"slug":27,"title":28,"published_at":29},"pentagon-cyber-chief-warns-cyber-demand-outpaces-capability","Pentagon Cyber Chief Warns: Cyber Demand Outpaces Capability","2026-09-23T20:21:24.567+00:00",{"slug":31,"title":32,"published_at":33},"white-house-authorizes-private-sector-offensive-cyber-operations","White House Authorizes Private Sector Offensive Cyber Operations","2026-08-14T08:20:50.491+00:00",{"slug":35,"title":36,"published_at":37},"spanish-insurer-fined-200k-after-ransomware-exposes-40000-records-and-dpia-failures","Spanish Insurer Fined €200K After Ransomware Exposes 40,000 Records and DPIA Failures","2026-07-08T10:21:46.082+00:00",{"slug":39,"title":40,"published_at":41},"200k-gdpr-fine-after-ransomware-exposes-40000-records-at-spanish-insurance-broker","€200K GDPR Fine After Ransomware Exposes 40,000 Records at Spanish Insurance Broker","2026-07-07T16:20:36.034+00:00",{"slug":43,"title":44,"published_at":45},"alkora-fined-200k-after-ransomware-exposes-40000-records-due-to-missing-dpia-and-weak-controls","Alkora Fined €200K After Ransomware Exposes 40,000 Records Due to Missing DPIA and Weak Controls","2026-07-03T12:21:18.936+00:00",{"slug":47,"title":48,"published_at":49},"unencrypted-ble-transmission-and-dos-flaw-expose-apollo-pharmacy-glucose-monitor-users","Unencrypted BLE Transmission and DoS Flaw Expose Apollo Pharmacy Glucose Monitor Users","2026-06-18T19:21:08.666+00:00",{"slug":51,"title":52,"published_at":53},"cisa-mandates-risk-based-vulnerability-prioritization-for-federal-agencies","CISA Mandates Risk-Based Vulnerability Prioritization for Federal Agencies","2026-06-10T16:21:20.491+00:00",{"slug":55,"title":56,"published_at":57},"poor-strategic-planning-cripples-federal-vulnerability-database-operations","Poor Strategic Planning Cripples Federal Vulnerability Database Operations","2026-05-29T18:21:01.269+00:00",{"slug":59,"title":60,"published_at":61},"nist-vulnerability-analysis-changes-create-new-organizational-responsibilities","NIST Vulnerability Analysis Changes Create New Organizational Responsibilities","2026-04-15T22:08:52.927+00:00",[63,68,72,76,80,84],{"slug":64,"name":65,"problem":66,"stories":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":69,"name":70,"problem":71,"stories":67},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":73,"name":74,"problem":75,"stories":67},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":77,"name":78,"problem":79,"stories":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":81,"name":82,"problem":83,"stories":67},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":85,"name":86,"problem":87,"stories":88},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[90,96,101,107,111,115,119,124],{"family":91,"item":92,"code":93,"title":94,"together":95},"cis","7","Control 7","Continuous Vulnerability Management",6,{"family":97,"item":98,"code":99,"title":100,"together":95},"gdpr","32","Article 32","Security of processing",{"family":102,"item":103,"code":104,"title":105,"together":106},"nist-csf","id-ra","ID.RA-1","Risk Assessment",4,{"family":91,"item":108,"code":109,"title":110,"together":106},"13","Control 13","Network Monitoring and Defense",{"family":112,"item":113,"code":114,"title":114,"together":106},"itil","overview","ITIL",{"family":91,"item":116,"code":117,"title":118,"together":106},"17","Control 17","Incident Response Management",{"family":97,"item":120,"code":121,"title":122,"together":123},"25","Article 25","Data protection by design and by default",3,{"family":97,"item":125,"code":126,"title":127,"together":123},"33","Article 33","Notification of a personal data breach to the supervisory authority"]