{"product_id":"cybersecurity-threat-risk-assessment-toolkit-nist-sp-800-30-iso-27005-word-excel","title":"Cybersecurity Threat \u0026 Risk Assessment Toolkit — NIST SP 800-30 \u0026 ISO 27005 (Word + Excel)","description":"\u003cp\u003eA complete, working threat and risk assessment system — not a blank register. The methodology follows NIST SP 800-30 Rev. 1 within the ISO\/IEC 27005 risk management process, with a threat catalogue, a vulnerability checklist, a 5×5 scoring workbook that calculates inherent and residual risk for you, a framework crosswalk for treatments, and an executive report template. Canada and U.S. annexes align the same assessment to HTRA\/ITSG-33 and to the NIST RMF\/CMMC — one toolkit, both markets.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eMethodology \u0026amp; framework mapping — everything this toolkit is built on and mapped to:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cem\u003eCore methodology\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST SP 800-30 Rev. 1\u003c\/strong\u003e — Guide for Conducting Risk Assessments (the assessment spine)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 27005\u003c\/strong\u003e — information security risk management process\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST Cybersecurity Framework (CSF) 2.0\u003c\/strong\u003e — Govern (GV.RA) and Identify (ID.RA) framing\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eControl mapping for risk treatments (Framework Crosswalk workbook)\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eISO\/IEC 27001:2022 Annex A\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST SP 800-53\u003c\/strong\u003e (also serves as the ITSG-33 Annex A reference for most controls)\u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eCIS Controls v8\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST CSF 2.0\u003c\/strong\u003e outcomes\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eCanada\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eHTRA\u003c\/strong\u003e — Government of Canada Harmonized Threat and Risk Assessment: terminology and phase alignment\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eITSG-33\u003c\/strong\u003e — IT Security Risk Management (Canadian Centre for Cyber Security): lifecycle and control catalogue alignment\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eUnited States\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST Risk Management Framework — SP 800-37 Rev. 2\u003c\/strong\u003e: lifecycle alignment\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCMMC 2.0 and NIST SP 800-171\u003c\/strong\u003e: requirement touchpoints for defense contractors, including POA\u0026amp;M\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Implementation Guide\u003c\/li\u003e\n\u003cli\u003eRisk Assessment Methodology Guide — the 800-30 method, likelihood\/impact scales, risk rules\u003c\/li\u003e\n\u003cli\u003eThreat Catalogue — adversarial, accidental, structural, and environmental threat events\u003c\/li\u003e\n\u003cli\u003eVulnerability Assessment Checklist — weakness areas mapped to the control frameworks\u003c\/li\u003e\n\u003cli\u003eCanada Annex — HTRA \u0026amp; ITSG-33 Alignment\u003c\/li\u003e\n\u003cli\u003eUS Annex — NIST RMF \u0026amp; CMMC Alignment\u003c\/li\u003e\n\u003cli\u003eRisk Assessment Workbook (Excel) — asset inventory, threat assessment, risk register with automatic 5×5 scoring, summary dashboard\u003c\/li\u003e\n\u003cli\u003eFramework Crosswalk \u0026amp; Treatment Plan (Excel) — 16 control areas mapped across ISO 27001, SP 800-53, CIS v8, and CSF 2.0\u003c\/li\u003e\n\u003cli\u003eAssessment Scope \u0026amp; Plan Form (Word)\u003c\/li\u003e\n\u003cli\u003eRisk Treatment \u0026amp; Acceptance Form (Word)\u003c\/li\u003e\n\u003cli\u003eExecutive Risk Report Template (Word)\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Security consultants, vCISOs, and internal IT\/security and risk teams in Canada and the U.S. who need to run defensible, repeatable threat and risk assessments — for ISO 27001 programs, client engagements, public-sector HTRA-style deliverables, or CMMC readiness — without building the machinery from scratch.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Scope the assessment on the Scope \u0026amp; Plan form, inventory the assets, select threat events from the catalogue, examine vulnerabilities with the checklist, and score in the register — likelihood and impact dropdowns drive automatic 5×5 scores and levels for both inherent and residual risk. Map treatments in the crosswalk, record acceptances on the signed form, and report with the executive template.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not a certification, audit, or guarantee of compliance with any framework named. Framework names describe the mappings provided. Confirm framework editions and client-specific requirements at the start of each engagement.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e\n","brand":"Zee Consulting","offers":[{"title":"Default","offer_id":67831375429819,"sku":"ZEE-TRA-006","price":249.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/cyber-tra-toolkit-cover.png?v=1792694979","url":"https:\/\/zeeconsulting.myshopify.com\/products\/cybersecurity-threat-risk-assessment-toolkit-nist-sp-800-30-iso-27005-word-excel","provider":"Zee Consulting Templates","version":"1.0","type":"link"}