Cybersecurity Threat & Risk Assessment Toolkit — NIST SP 800-30 & ISO 27005 (Word + Excel)

A complete, working threat and risk assessment system — not a blank register. The methodology follows NIST SP 800-30 Rev. 1 within the ISO/IEC 27005 risk management process, with a threat catalogue, a vulnerability checklist, a 5×5 scoring workbook that calculates inherent and residual risk for you, a framework crosswalk for treatments, and an executive report template. Canada and U.S. annexes align the same assessment to HTRA/ITSG-33 and to the NIST RMF/CMMC — one toolkit, both markets.

Methodology & framework mapping — everything this toolkit is built on and mapped to:

Core methodology

• NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments (the assessment spine)
• ISO/IEC 27005 — information security risk management process
• NIST Cybersecurity Framework (CSF) 2.0 — Govern (GV.RA) and Identify (ID.RA) framing

Control mapping for risk treatments (Framework Crosswalk workbook)

• ISO/IEC 27001:2022 Annex A
• NIST SP 800-53 (also serves as the ITSG-33 Annex A reference for most controls)
• CIS Controls v8
• NIST CSF 2.0 outcomes

Canada

• HTRA — Government of Canada Harmonized Threat and Risk Assessment: terminology and phase alignment
• ITSG-33 — IT Security Risk Management (Canadian Centre for Cyber Security): lifecycle and control catalogue alignment

United States

• NIST Risk Management Framework — SP 800-37 Rev. 2: lifecycle alignment
• CMMC 2.0 and NIST SP 800-171: requirement touchpoints for defense contractors, including POA&M

What's included (12 items):

• Start Here Implementation Guide
• Risk Assessment Methodology Guide — the 800-30 method, likelihood/impact scales, risk rules
• Threat Catalogue — adversarial, accidental, structural, and environmental threat events
• Vulnerability Assessment Checklist — weakness areas mapped to the control frameworks
• Canada Annex — HTRA & ITSG-33 Alignment
• US Annex — NIST RMF & CMMC Alignment
• Risk Assessment Workbook (Excel) — asset inventory, threat assessment, risk register with automatic 5×5 scoring, summary dashboard
• Framework Crosswalk & Treatment Plan (Excel) — 16 control areas mapped across ISO 27001, SP 800-53, CIS v8, and CSF 2.0
• Assessment Scope & Plan Form (Word)
• Risk Treatment & Acceptance Form (Word)
• Executive Risk Report Template (Word)
• Copyright & Licence Terms

Who it's for: Security consultants, vCISOs, and internal IT/security and risk teams in Canada and the U.S. who need to run defensible, repeatable threat and risk assessments — for ISO 27001 programs, client engagements, public-sector HTRA-style deliverables, or CMMC readiness — without building the machinery from scratch.

How it works: Scope the assessment on the Scope & Plan form, inventory the assets, select threat events from the catalogue, examine vulnerabilities with the checklist, and score in the register — likelihood and impact dropdowns drive automatic 5×5 scores and levels for both inherent and residual risk. Map treatments in the crosswalk, record acceptances on the signed form, and report with the executive template.

Please note: Templates and general information, not a certification, audit, or guarantee of compliance with any framework named. Framework names describe the mappings provided. Confirm framework editions and client-specific requirements at the start of each engagement.

Copyright & licence: © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright & Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.

Requirements: Microsoft Word and Excel (or compatible: Google Docs/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.