Perform preliminary risk assessment and impact analysis

task australia Updated Sep 10, 2026 1 min read perform-risk-assess-impact-analysis.md

Perform a preliminary risk assessment and impact analysis of the target.

Before you begin

Note: Starting with version 10.1.0, the NIST RMF Use Case Accelerator will be supported only for customers who currently use the product. New and existing customers should consider using the GRC: Continuous Authorization Monitoring application. For details, Continuous Authorization and Monitoring.

Role required: sn_irm_nist_rmf.risk_executive or sn_irm_nist_rmf.security_officer

Procedure

Navigate to All > NIST RMF > Categorize > Impact Analysis.
Search for the target using the Name or Profile fields.
Select and open the target record.

Open the target record again and update the following fields in the NIST RMF section:

Note: Review NIST RMF supporting concepts, for more detailed information about these fields.

Field	Description
Confidentiality	Target category based on confidentiality. Identify the security objective as: High, Moderate, or Low.
Integrity	Target category based on integrity. Identify the security objective as: High, Moderate, or Low.
Availability	Target category based on availability. Identify the security objective as: High, Moderate, or Low.
Impact	Impact to business function if the target loses its confidentiality, integrity, or availability. Impact is automatically determined and may be overridden.
Scoping Considerations	Operational or environmental scoping considerations for the target.
Risk Executive	Names of the person who ensures risks are identified and managed.
Authorizing Official	Name of the person who verifies that the target is operating with an acceptable level of risk.
Justification	Security posture description for risk executive, authorizing official, and owner.
Approval status	Status of the security compliance posture of the target.

Verify that the NIST RMF related lists are visible:
- Baseline Policy Statements
- Baseline Controls
- Risks
- Approvals
Navigate to the NIST RMF tab and review the Baseline Policy Statements.
Implement security controls for the target following the standard approach outlined in the Policy and Compliance Management application.

Parent Topic:Categorize targets

62 lines · 3.5 KB Wrap lines

---
title: Perform preliminary risk assessment and impact analysis
description: Perform a preliminary risk assessment and impact analysis of the target.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/grc-common-functions/perform-risk-assess-impact-analysis.html
release: australia
product: GRC Common Functions
classification: grc-common-functions
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Categorize targets, Process overview, NIST RMF Use Case Accelerator, GRC use case accelerators, Common GRC features, Governance, Risk, and Compliance]
---

# Perform preliminary risk assessment and impact analysis

Perform a preliminary risk assessment and impact analysis of the target.

## Before you begin

**Note:** Starting with version 10.1.0, the NIST RMF Use Case Accelerator will be supported only for customers who currently use the product. New and existing customers should consider using the GRC: Continuous Authorization Monitoring application. For details, [Continuous Authorization and Monitoring](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/continuous-risk-monitoring/grc-cam-landing-page.md).

Role required: sn\_irm\_nist\_rmf.risk\_executive or sn\_irm\_nist\_rmf.security\_officer

## Procedure

1. Navigate to **All** &gt; **NIST RMF** &gt; **Categorize** &gt; **Impact Analysis**.

2. Search for the target using the **Name** or **Profile** fields.

3. Select and open the target record.

4. Open the target record again and update the following fields in the NIST RMF section:

**Note:** Review [NIST RMF supporting concepts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-common-functions/grc-nist-rmf-key-concepts.md), for more detailed information about these fields.

|Field|Description|
|-----|-----------|
|Confidentiality|Target category based on confidentiality. Identify the security objective as: High, Moderate, or Low.|
|Integrity|Target category based on integrity. Identify the security objective as: High, Moderate, or Low.|
|Availability|Target category based on availability. Identify the security objective as: High, Moderate, or Low.|
|Impact|Impact to business function if the target loses its confidentiality, integrity, or availability. Impact is automatically determined and may be overridden.|
|Scoping Considerations|Operational or environmental scoping considerations for the target.|
|Risk Executive|Names of the person who ensures risks are identified and managed.|
|Authorizing Official|Name of the person who verifies that the target is operating with an acceptable level of risk.|
|Justification|Security posture description for risk executive, authorizing official, and owner.|
|Approval status|Status of the security compliance posture of the target.|

5. Verify that the NIST RMF related lists are visible:

- Baseline Policy Statements
- Baseline Controls
- Risks
- Approvals
6. Navigate to the **NIST RMF** tab and review the **Baseline Policy Statements**.

7. Implement security controls for the target following the standard approach outlined in the Policy and Compliance Management application.

**Parent Topic:**[Categorize targets](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/grc-common-functions/rmf-categorize.md)