How to use the NIST 800-30 Cyber Risk Assessment agent skill

What is an agent skill and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file of instructions, plus optional templates, reference notes and scripts that an AI agent can load when a task matches the skill's description. This skill is for producing an actual risk assessment: an analysis of specific threats, likelihoods and impacts, not a maturity score.

Once installed, the agent follows the four steps of NIST SP 800-30 Rev 1. It prepares scope and a risk model, identifies threat sources, threat events and vulnerabilities, rates likelihood and impact, and produces a prioritized risk register with suggested treatments: mitigate, transfer, avoid or accept.

• Prepare: purpose, scope, assumptions and the risk scales
• Conduct: threat sources, threat events, vulnerabilities, likelihood, impact and risk
• Communicate: a ranked risk register and executive briefing
• Maintain and treat: refresh triggers and treatment decisions

How do you install the skill?

Download the skill ZIP from this page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/conducting-cyber-risk-assessment-with-nist-800-30/
• Project install: .claude/skills/conducting-cyber-risk-assessment-with-nist-800-30/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need to type a command. The skill's description lists the situations it covers, so ask the agent in plain language. Useful triggers include asking what your top risks are and how bad they are, asking for a risk register for a new system, or asking for a documented risk analysis to support a framework such as ISO 27001, NIST CSF, RMF, SOC 2 or PCI.

Give the agent the context it needs: the systems in scope, the data they handle, and any threat or vulnerability data you have. The skill notes that outputs without these inputs would be guesses.

• "What are our top cyber risks for the customer portal, ranked, with a rationale I can defend to the board?"
• "Build a risk register from scratch for our new payments API using NIST SP 800-30."
• "We need a documented risk analysis for our ISO 27001 6.1.2 requirement. Here is our asset inventory and scan results."

How does the bundled scoring script work?

The skill includes scripts/process.py. It can score a JSON list of risks against a 5x5 matrix and output a ranked Markdown register. You prepare the JSON input yourself; the source does not describe its exact field names, so check the script's own code or the agent's output before relying on it.

Python 3 is required to run the script. The skill needs no API keys or accounts.

• Requires Python 3 to run scripts/process.py
• Input: a JSON file of risk inputs you prepare
• Output: a ranked Markdown risk register on a 5x5 matrix

What do the supporting files contain?

The skill includes assets/template.md, a filled worked example of a risk assessment report for a mid-size SaaS company's internet-facing application tier. Replace the bracketed content with your own assessment. references/standards.md lists companion standards such as NIST SP 800-39, NIST SP 800-37 Rev 2, NIST SP 800-53 Rev 5, FIPS 199 and 200, MITRE ATT&CK and FAIR.

• assets/template.md: worked example report structure
• references/standards.md: companion standards and roles
• scripts/process.py: 5x5 matrix scoring and ranked Markdown output
• SKILL.md: the instructions the agent follows

What are the safety notes and limits?

The skill runs scripts, so review scripts/process.py before running it on sensitive data. According to the source, the skill does not use the network. Its output is a draft that needs qualified review; it is not legal or certified compliance sign-off.

The skill is not suited to quick maturity scoring or checklist audits. Do not rely on it where asset inventory, vulnerability data or business context are missing, because the results would be guesses that could mislead decision-makers.

• Runs scripts: yes (scripts/process.py)
• Uses network: no
• Draft output: needs qualified review before use
• Not a maturity or checklist audit tool

What tips help get better results?

Agree the risk model and scales before scoring so results are comparable and repeatable. Gather asset, vulnerability and business-impact inputs first. Re-assess when a new system, major architecture change, significant incident or new threat intelligence appears.

Ask the agent for residual risk after planned controls, so decision-makers can see the post-treatment position.

• Lock the scales (qualitative or semi-quantitative) before scoring
• Ground threat events in observed behavior and map adversarial events to MITRE ATT&CK
• Track risk-acceptance decisions with an authorizing signature
• Set a refresh cadence for the assessment