---
tags:
  - Rev5
  - Controls
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Risk Assessment (RA)

This page contains all **22** controls and control enhancements in the Risk Assessment (RA) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.

!!! info "Official NIST OSCAL source"
    - **Catalog version:** 5.2.0
    - **OSCAL version:** 1.2.2
    - **Catalog last modified:** May 11, 2026

## RA-01 (Policy and Procedures) { #ra-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
        - **1.** [Selection: one or more of: organization-level; mission/business process-level; system-level] risk assessment policy that:
            - **(a)** Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            - **(b)** Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        - **2.** Procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls;
    - **b.** Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the risk assessment policy and procedures; and
    - **c.** Review and update the current risk assessment:
        - **1.** Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
        - **2.** Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-1)

---

## RA-02 (Security Categorization) { #ra-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Categorize the system and information it processes, stores, and transmits;
    - **b.** Document the security categorization results, including supporting rationale, in the security plan for the system; and
    - **c.** Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-2)

---

## RA-02 (01) (Impact-level Prioritization) { #ra-02-01 }

!!! quote ""
    Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-2-1)

---

## RA-03 (Risk Assessment) { #ra-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Conduct a risk assessment, including:
        - **1.** Identifying threats to and vulnerabilities in the system;
        - **2.** Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
        - **3.** Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
    - **b.** Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;
    - **c.** Document risk assessment results in [Selection: one of: security and privacy plans; risk assessment report];
    - **d.** Review risk assessment results [Assignment: organization-defined frequency];
    - **e.** Disseminate risk assessment results to [Assignment: organization-defined personnel or roles]; and
    - **f.** Update the risk assessment [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-3)

---

## RA-03 (01) (Supply Chain Risk Assessment) { #ra-03-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **(a)** Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services]; and
    - **(b)** Update the supply chain risk assessment [Assignment: organization-defined frequency], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-3-1)

---

## RA-03 (02) (Use of All-source Intelligence) { #ra-03-02 }

!!! quote ""
    Use all-source intelligence to assist in the analysis of risk.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-3-2)

---

## RA-03 (03) (Dynamic Threat Awareness) { #ra-03-03 }

!!! quote ""
    Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-3-3)

---

## RA-03 (04) (Predictive Cyber Analytics) { #ra-03-04 }

!!! quote ""
    Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-3-4)

---

## RA-05 (Vulnerability Monitoring and Scanning) { #ra-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
    - **b.** Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
        - **1.** Enumerating platforms, software flaws, and improper configurations;
        - **2.** Formatting checklists and test procedures; and
        - **3.** Measuring vulnerability impact;
    - **c.** Analyze vulnerability scan reports and results from vulnerability monitoring;
    - **d.** Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
    - **e.** Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
    - **f.** Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5)

---

## RA-05 (02) (Update Vulnerabilities to Be Scanned) { #ra-05-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Update the system vulnerabilities to be scanned [Selection: one or more of: prior to a new scan; when new vulnerabilities are identified and reported].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-2)

---

## RA-05 (03) (Breadth and Depth of Coverage) { #ra-05-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Define the breadth and depth of vulnerability scanning coverage.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-3)

---

## RA-05 (04) (Discoverable Information) { #ra-05-04 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-4)

---

## RA-05 (05) (Privileged Access) { #ra-05-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-5)

---

## RA-05 (06) (Automated Trend Analyses) { #ra-05-06 }

!!! quote ""
    Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-6)

---

## RA-05 (08) (Review Historic Audit Logs) { #ra-05-08 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-8)

---

## RA-05 (10) (Correlate Scanning Information) { #ra-05-10 }

!!! quote ""
    Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-10)

---

## RA-05 (11) (Public Disclosure Program) { #ra-05-11 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-5-11)

---

## RA-06 (Technical Surveillance Countermeasures Survey) { #ra-06 }

!!! quote ""
    Employ a technical surveillance countermeasures survey at [Assignment: organization-defined locations] [Selection: one or more of: when].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-6)

---

## RA-07 (Risk Response) { #ra-07 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-7)

---

## RA-08 (Privacy Impact Assessments) { #ra-08 }

!!! quote ""
    Conduct privacy impact assessments for systems, programs, or other activities before:
    
    - **a.** Developing or procuring information technology that processes personally identifiable information; and
    - **b.** Initiating a new collection of personally identifiable information that:
        - **1.** Will be processed using information technology; and
        - **2.** Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-8)

---

## RA-09 (Criticality Analysis) { #ra-09 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-9)

---

## RA-10 (Threat Hunting) { #ra-10 }

!!! quote ""
    - **a.** Establish and maintain a cyber threat hunting capability to:
        - **1.** Search for indicators of compromise in organizational systems; and
        - **2.** Detect, track, and disrupt threats that evade existing controls; and
    - **b.** Employ the threat hunting capability [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ra-10)

---
