Which two frameworks are commonly cited for risk assessment in trusted environments?

• A. COBIT and ITIL
• B. NIST SP 800-30 and ISO 31000
• C. PCI DSS and HIPAA
• D. NIST SP 800-53 and ISO 9001

Answer: (B)

Risk assessment in trusted environments relies on frameworks that give you a clear, repeatable method to identify what could go wrong, how it could happen, and how serious the consequences would be. The strongest combination here pairs a practical IT-specific risk assessment guide with an international, organization-wide risk management standard.

NIST SP 800-30 provides a detailed, step-by-step approach for assessing information-system risks. It walks you through identifying assets, threats, and vulnerabilities, estimating impact and likelihood, calculating risk, and outlining appropriate mitigations and risk responses. This makes it highly actionable for evaluating security and privacy risks within IT systems and operations.

ISO 31000, on the other hand, offers a universal framework for risk management that applies to any organization or activity. It covers principles, a structured framework, and a process for risk identification, analysis, evaluation, treatment, monitoring, and communication. Because it’s general-purpose, it complements the IT-specific guidance by giving a consistent, organization-wide way to think about risk and ensure actions align with overall governance and objectives.

Together, they’re frequently cited in trusted environments because one provides concrete, hands-on methods for IT risk assessment while the other ensures a coherent, overarching approach to managing risk across the organization.

Choices that focus on governance or service management (like COBIT or ITIL), or on regulatory/compliance requirements without a general risk-assessment framework, don’t provide the same combination of practical IT risk assessment steps plus a broad, applicable risk-management structure. Similarly, a controls catalog or a quality-management standard doesn’t single out risk assessment in the same way.