Internal Risk Assessment Report

Risk Assessment Report (RAR) is the second

deliverable/artifact at the categorization Phase it contains:

• System description
• Scope/boundary
• Threat
• Vulnerability/Weakness
• Impact
• Likelihood
• Recommendation to avoid risk

Sample Risk Assessment Report (RAR) NIST Publications

• NIST SP 800-30
• NIST SP 800-37