Name and briefly describe two common risk assessment methodologies used in industrial security.

• A. COBIT and ITIL are risk assessment methodologies designed for manufacturing risk.
• B. ISO 27001 and PCI DSS define controls but do not provide risk assessment processes.
• C. Six Sigma and Lean are risk assessment methodologies used in security.
• D. NIST SP 800-30 provides a structured process for identifying threats, vulnerabilities, and impacts; ISO 31000 offers principles and a generic framework for risk management.

Answer: (D)

The main idea is knowing which frameworks are specifically built to guide how to assess risk. NIST SP 800-30 offers a structured, repeatable process for identifying threats, vulnerabilities, and impacts, then evaluating likelihood and consequence to produce a prioritized risk picture with recommended mitigations. It’s very hands-on and action-oriented, making it a go-to method for performing formal risk assessments in industrial security programs.

ISO 31000, on the other hand, provides a broad set of principles and a generic framework for risk management that can be applied across the whole organization. It isn’t a step-by-step procedure for a single assessment, but a governance-oriented approach that helps integrate risk assessment and treatment into planning, decision-making, and continual improvement. It ensures consistency and context alignment across departments and activities.

Together, these two are commonly cited because one delivers a concrete risk assessment method (identify threats, vulnerabilities, impacts; determine risk), while the other provides a versatile, organization-wide framework to manage risk over time.

The other options don’t fit as well because COBIT and ITIL are primarily governance and service-management frameworks, not specific risk assessment methodologies. Six Sigma and Lean focus on process efficiency and waste reduction, not on formal risk identification and scoring. ISO 27001 and PCI DSS define controls and requirements, and while they require risk considerations, they do not prescribe a distinct, widely adopted risk assessment process in the same way NIST SP 800-30 and ISO 31000 do.