- Area
- Risk Management
- Framework
- NIST SP 800-30 Rev 1
- Controls
- RA-3 — Risk Assessment, PM-9 — Risk Management Strategy, PM-28 — Risk Framing
Documents
What I did
Assessed 20 risks for SDIS, a fictional moderate-impact healthcare SaaS platform that handles PHI. For each risk I identified the affected assets, threat source and weakness, scored likelihood and impact (1–5), and mapped treatment to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and SOC 2. After treatment, Critical risks dropped from 7 to 0 and total risk score fell 52%. I also built an interactive NIST → ISO 27001 → SOC 2 crosswalk of all 298 base controls to support the mapping.
What I learned
Inherent vs. residual scoring is what makes a register useful to leadership: it shows exactly how much risk each control investment buys down. Mapping one control set to three frameworks also showed me how a single piece of evidence can satisfy HIPAA, ISO and SOC 2 auditors at once.