Which risk assessment framework is commonly referenced in trusted environments?

• A. ISO 9001
• B. NIST SP 800-30
• C. COBIT
• D. PCI DSS

Answer: (B)

In trusted environments, risk assessment is approached with a structured, guideline-driven process, and the most commonly referenced framework for this is NIST SP 800-30. This guide, titled Guide for Conducting Risk Assessments, walks you through identifying assets, threats, and vulnerabilities, then assessing likelihood and impact to determine overall risk. It emphasizes documenting risk levels and developing concrete recommendations for controls, making it directly usable for shaping security decisions and controls.

NIST SP 800-30 is closely aligned with the broader risk management workflow used in government and regulated sectors, often within the NIST Risk Management Framework and in conjunction with security controls from SP 800-53. That compatibility and focus on formal risk determination is why it’s the go-to reference in trusted environments.

The other options serve different purposes. ISO 9001 centers on quality management systems, not risk assessment in security contexts. COBIT is a governance and management framework for IT processes, which covers risk at a governance level but isn’t a risk assessment guide itself. PCI DSS targets security requirements specific to payment card data, not general risk assessment for trusted environments.