Risk Response RA-7

Source: NIST SP 800-53 Rev.5, Risk Assessment family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

RA-7 (Risk Response) is about what you do after a finding shows up. When an assessment, a scan, monitoring, or an audit turns up a weakness, you decide how to handle it — fix it, reduce it, transfer it, or formally accept it — and you make that decision within the level of risk your organization is willing to live with. It is a Low-baseline control that closes the loop on the risks you find.

What good looks like

• For each finding, choose a response: remediate (fix it), mitigate (reduce it), transfer it, or accept it.
• Make the choice against a stated risk tolerance — how much risk is acceptable here.
• Prioritize responses so the most serious findings get handled first.
• Track each response to closure so nothing quietly falls off the list.
• Keep a record of decisions, including who accepted any risk that was not fixed.

Framework mapping

• NIST CSF 2.0 — ID.RA-06 — Risk responses are chosen, prioritized, planned, tracked, and communicated
• CIS Controls v8 — Control 7 — Continuous Vulnerability Management

How to move it toward Implemented

• Pull the current findings for the lab server into one list (for example, a vulnerability scan report, or missing patches from apt list --upgradable).
• For each finding, record the chosen response and a priority; for anything you patch, apply it (sudo apt update && sudo apt upgrade) and note the date.
• For risks you accept instead of fixing, write a short justification and name who accepted them — then keep the whole thing as a dated, updatable file (for example, /var/log/plumbtrack/risk-response-log.md).
• Attach that risk-response log as hardening evidence on the asset, naming RA-7 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.