NIST 800-30 Cyber Risk Assessment
Run a structured cyber risk assessment and produce a ranked risk register
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
Once installed, the agent follows the NIST SP 800-30 Rev 1 method to assess an organization's cyber risks: defining scope and scales, identifying threat sources, threat events and vulnerabilities, rating likelihood and impact, and producing a prioritized risk register with suggested treatments (mitigate, transfer, avoid or accept). A bundled Python script can score a JSON list of risks against a 5x5 matrix and output a ranked Markdown register.
Great for
- Security or GRC staff who must produce a documented risk analysis for ISO 27001, NIST CSF, RMF, SOC 2 or PCI
- Teams preparing an authorization (ATO) or risk review for a new system or major change
- Leaders who need a defensible, ranked list of top cyber risks
Skip it if
- Quick maturity scoring or checklist audits, since the skill is for threat-based risk analysis, not maturity measurement
- Organizations without asset inventory, vulnerability data or business context; outputs would be guesses and could mislead decision-makers
- Anyone expecting legal or certified compliance sign-off; the output is a draft that needs qualified review
Try asking
- “Walk me through a NIST 800-30 risk assessment for our customer portal and build a risk register”
- “Score these five threat events with likelihood and impact and rank them highest-risk first”
- “Draft a risk treatment plan with residual risk for our top risks for the board”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
conducting-cyber-risk-assessment-with-nist-800-30.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip conducting-cyber-risk-assessment-with-nist-800-30.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip conducting-cyber-risk-assessment-with-nist-800-30.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Agree on the risk model and scales (for example 5x5 qualitative) before scoring so results are repeatable.
- Supply real asset inventory, vulnerability scan results and incident history; the method is only as good as its inputs.
- Review the script's default matrix and override it if your organization uses different risk-level thresholds.
What's inside
- assets/template.md
- references/standards.md
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.