Risk assessment in the NIST CSF

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · NIST CSF

Risk assessment is where the CSF stops listing assets and starts deciding what to worry about — the input that makes the whole program risk-based.

From assets to risk

Within Identify, risk assessment is the step that turns "here is what we have" into "here is what could go wrong and how badly." It evaluates the threats and vulnerabilities facing your assets and the potential business impact, producing a prioritised risk picture rather than a flat list.

What it covers

A CSF risk assessment identifies threats (what could happen), vulnerabilities (weaknesses that could be exploited), likelihood, and impact — and uses them to prioritise. CSF 2.0 emphasises tying this to your business context and risk tolerance, so the assessment reflects what matters to your organisation specifically.

It drives everything downstream

The point of assessing risk is to direct effort: the high risks earn the strongest Protect safeguards, the closest Detect monitoring, and the clearest Respond/Recover plans. Without it, you spread controls uniformly and over-protect the trivial while under-protecting the critical.

Keep it current

Risk is not static — new systems, vendors, and threats change the picture, so the assessment is reviewed and updated, feeding the governance and oversight cycle. SentinelPanda links assets to risks and keeps the assessment current as your environment changes.