Use ISO/IEC 27005:2022 for the full information-security risk cycle in an ISMS. Use for detailed assessment of threats, vulnerabilities, likelihood, impact, and uncertainty.
NIST SP 800-30 was written for U.S. federal information systems and organizations. A non-federal organization may adopt it, but the publication alone is not a universal legal mandate or certification.
ISO/IEC 27005:2022 and overlap in risk assessment but have different boundaries. ISO/IEC 27005 covers context, assessment, treatment, acceptance, communication, records, monitoring, and review in support of an ISO/IEC 27001 ISMS. NIST SP 800-30 Rev. 1, published in September 2012, gives detailed U.S. federal guidance for preparing, conducting, communicating, and maintaining risk assessments at organization, mission or business-process, and information-system levels. Use the publication expected by the governing assurance context, or map NIST's assessment detail into the ISO risk-management cycle.
ISO/IEC 27005 vs NIST SP 800-30 side-by-side comparison
ISO/IEC 27005 vs NIST SP 800-30 Rev. 1: practical differences
Compare purpose, scope, method, records, review, and reuse without treating voluntary guidance as a legal or standalone certification requirement.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Preparing for, conducting, communicating, and maintaining risk assessments at organization, mission/business-process, and information-system levels.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Stakeholders depend on the assessment tier and purpose and can include senior leaders, risk executives, authorizing officials, mission or business owners, system owners, assessors, and security staff.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Use for initial or updated assessments that inform risk-management, authorization, and monitoring decisions at the relevant tier.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Establish context and criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Prepare; identify threat sources and events, vulnerabilities, and predisposing conditions; determine likelihood, impact, and risk; communicate results; and maintain the assessment.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Assessment purpose and scope, assumptions and constraints, information sources, threat and vulnerability analysis, likelihood, impact, risk determination, results, and maintenance records.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Maintain assessments in response to monitoring and change; cadence follows the organization's risk-management and authorization strategy.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
A NIST Special Publication, not a certification. It is federal guidance and becomes mandatory only when an applicable law, Federal Information Processing Standard (FIPS), Office of Management and Budget (OMB) policy, agency rule, contract, or other requirement invokes it.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Reuse inventories, scenarios, threats, vulnerabilities, control evidence, consequence/impact data, likelihood rationale, and risk results after mapping terminology and criteria.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
Use NIST SP 800-30 when federal or contractual context expects it, or when its assessment model fits the decision.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Preparing for, conducting, communicating, and maintaining risk assessments at organization, mission/business-process, and information-system levels.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Stakeholders depend on the assessment tier and purpose and can include senior leaders, risk executives, authorizing officials, mission or business owners, system owners, assessors, and security staff.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Use for initial or updated assessments that inform risk-management, authorization, and monitoring decisions at the relevant tier.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This NIST publication supports the comparator side by identifying SP 800-30 Rev. 1 as guidance for conducting risk assessments.
Guide for Conducting Risk Assessments
Process
ISO/IEC 27005
Establish context and criteria; identify owners and risks; analyse and evaluate risks; select treatment and controls; approve the plan and residual risk; communicate, record, monitor, and review.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Prepare; identify threat sources and events, vulnerabilities, and predisposing conditions; determine likelihood, impact, and risk; communicate results; and maintain the assessment.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Assessment purpose and scope, assumptions and constraints, information sources, threat and vulnerability analysis, likelihood, impact, risk determination, results, and maintenance records.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This NIST publication supports the comparator side by identifying SP 800-30 Rev. 1 as guidance for conducting risk assessments.
Guide for Conducting Risk Assessments
Review cycle
ISO/IEC 27005
Longer strategic cycles address context changes; shorter operational cycles update scenarios and treatment, with additional reviews after material change.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Maintain assessments in response to monitoring and change; cadence follows the organization's risk-management and authorization strategy.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This NIST publication supports the comparator side by identifying SP 800-30 Rev. 1 as guidance for conducting risk assessments.
Guide for Conducting Risk Assessments
Certification and assurance limits
ISO/IEC 27005
Guidance, not a standalone certification. ISO/IEC 27001 is the certifiable ISMS requirements standard; adopted 27005 practices can be examined as supporting evidence.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
A NIST Special Publication, not a certification. It is federal guidance and becomes mandatory only when an applicable law, Federal Information Processing Standard (FIPS), Office of Management and Budget (OMB) policy, agency rule, contract, or other requirement invokes it.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Reuse inventories, scenarios, threats, vulnerabilities, control evidence, consequence/impact data, likelihood rationale, and risk results after mapping terminology and criteria.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
Guidance on managing information security risks
NIST SP 800-30 Rev. 1
Use NIST SP 800-30 when federal or contractual context expects it, or when its assessment model fits the decision.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This NIST publication supports the comparator side by identifying SP 800-30 Rev. 1 as guidance for conducting risk assessments.
Guide for Conducting Risk Assessments
Practical decision rule
How should teams choose between ISO/IEC 27005 and NIST SP 800-30 Rev. 1?
Identify the controlling policy, contract, certification objective, and assessment decision before selecting the publication.
Use NIST SP 800-30 for detailed threat, vulnerability, likelihood, impact, and uncertainty analysis; use ISO/IEC 27005 for the surrounding ISMS risk cycle.
Document terminology, scale, time-horizon, authority, and evidence mappings rather than treating similar labels as equivalent.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.
This NIST publication supports the comparator side by identifying SP 800-30 Rev. 1 as guidance for conducting risk assessments.
Guide for Conducting Risk Assessments
1
Section 1
How do ISO/IEC 27005 and NIST SP 800-30 differ?
ISO/IEC 27005:2022 supplies information-security risk-management guidance for organizations using or improving an ISO/IEC 27001 ISMS. It carries the result beyond assessment into treatment options, necessary controls, a treatment plan, owner approval, residual-risk acceptance, communication, recording, monitoring, and review.
concentrates on risk assessment within the U.S. federal risk-management framework. It prepares the assessment, identifies threat sources and events, identifies vulnerabilities and predisposing conditions, determines likelihood and impact, determines risk, communicates results, and maintains the assessment. It applies those tasks at Tier 1 for the organization, Tier 2 for mission or business processes, and Tier 3 for information systems. It does not replace the separate risk-response and authorization processes in the wider NIST framework.
Choose the governing publication from the applicable law, policy, contract, customer assurance requirement, or ISMS design.
Use NIST's threat, vulnerability, likelihood, impact, and uncertainty detail inside an ISO/IEC 27005 assessment when that improves the analysis.
Keep treatment approval and residual-risk acceptance in the governing process; an assessment result does not make those decisions by itself.
NIST identifies the September 2012 publication as guidance for assessing federal information systems and organizations and summarizes its prepare, conduct, and maintain steps.
2
Section 2
Which records make the chosen approach reviewable?
Keep the assessment purpose, scope, assumptions, constraints, time frame, information sources, risk model, analysis approach, and decision recipients. For NIST-style analysis, record relevant threat sources and events, vulnerabilities and predisposing conditions, existing controls, likelihood of initiation or occurrence, likelihood of impact, impact rationale, risk determination, and uncertainty.
Map those records to the ISO/IEC 27005 risk statement, criteria, owner, evaluation, treatment options, necessary controls, plan approval, residual-risk acceptance, communication, and review trigger. Preserve the original terminology when a concept is not equivalent.
Link conclusions to current source evidence and assumptions.
Keep approval, version, date, owner, and review trigger with the decision.
Record uncertainty and exceptions instead of hiding them in a score.
NIST grounds the assessment purpose, scope, assumptions, constraints, threat and vulnerability analysis, likelihood, impact, uncertainty, communication, and maintenance records.
Recommended next step
Connect assessment to treatment and acceptance
Document the terminology, scale, evidence, treatment, residual-risk authority, and review mapping.
Set the ISO/IEC 27005 scope, purpose, criteria, and risk owner, then use NIST SP 800-30 tasks to structure the assessment. NIST's threat-event, vulnerability, predisposing-condition, likelihood, impact, and uncertainty analysis can supply evidence for ISO risk identification and analysis.
Evaluate the result against the organization's ISO risk criteria. Then select treatment options and necessary controls, approve the treatment plan, obtain the authorized residual-risk decision, and define communication and monitoring. Record any differences in scales, time horizons, and risk models.
Prepare: identify the decision, tier, purpose, scope, assumptions, constraints, time frame, information sources, risk model, analysis approach, and recipients.
Conduct: identify relevant threat sources and events, vulnerabilities and predisposing conditions, existing safeguards, likelihood of initiation or occurrence, likelihood of adverse impact, impact, risk, rationale, and uncertainty.
Translate: map the NIST result to the ISO scenario, owner, consequence and likelihood criteria, treatment priority, and necessary controls without assuming similarly named scales are equivalent.
Decide and maintain: route treatment, residual-risk acceptance, communication, authorization, and review through the governing process; update the assessment when monitoring or changed conditions can alter the result.
NIST describes risk assessment as part of a wider organizational risk-management process, supporting use of its assessment detail within another governing cycle.
4
Section 4
Which comparison mistakes should teams avoid?
Do not present either publication as a universal legal mandate. NIST SP 800-30 is a Special Publication written for federal information systems and organizations; whether it is mandatory depends on the applicable federal policy or other requirement. A private organization may adopt it voluntarily.
Do not claim that a completed NIST assessment establishes ISO/IEC 27001 conformity, or that ISO terminology proves a federal authorization requirement was met. Do not hide uncertainty inside a single score: NIST allows qualitative, quantitative, and semiquantitative approaches and calls for assumptions and uncertainty to be explicit.
Do not present guidance as a legal mandate or standalone certification requirement.
Do not confuse a template, matrix, or register with evidence that the process operated.
Do not leave ownership, rationale, residual risk, or review conditions implicit.
The official publication record identifies SP 800-30 Rev. 1 as federal risk-assessment guidance; the publication explains qualitative, quantitative, and semiquantitative approaches and their uncertainty limits.
5
Section 5
When should the chosen approach be reviewed?
Maintain the assessment when monitoring reveals new threats, vulnerabilities, predisposing conditions, control changes, impacts, or uncertainty that could change the result. Also review the mapping when the organizational scope, assessment tier, risk model, assessment method, criteria, evidence sources, authorization strategy, ISMS, or assurance commitments change. Neither publication imposes one universal annual deadline.
Set a planned review date.
Define event-driven triggers and evidence owners.
Preserve change history so reviewers can understand why the decision changed.
Official NIST publication record for the September 2012 federal risk-assessment guidance, its purpose, scope, and process.
NIST identifies the September 2012 publication as guidance for assessing federal information systems and organizations and summarizes its prepare, conduct, and maintain steps.
NIST grounds the assessment purpose, scope, assumptions, constraints, threat and vulnerability analysis, likelihood, impact, uncertainty, communication, and maintenance records.
Show 3 more
NIST describes risk assessment as part of a wider organizational risk-management process, supporting use of its assessment detail within another governing cycle.
The official publication record identifies SP 800-30 Rev. 1 as federal risk-assessment guidance; the publication explains qualitative, quantitative, and semiquantitative approaches and their uncertainty limits.
NIST includes maintaining the assessment as part of the process and ties updates to monitoring and changed risk information.
ISO's official listing identifies the fourth edition as guidance for managing information security risks.
This ISO listing supports the ISO/IEC 27005 side of the comparison by identifying it as guidance for managing information security risks in an ISMS context.