Only the English version of this standard is ANSI approved. This Standard provides guidance on developing and sustaining a coherent and effective risk assessment program including principles, managing an overall risk assessment program, and performing individual risk assessments, along with confirming the competencies of risk assessors and understanding biases. This Standard describes a well-defined risk assessment program and individual assessments to provide the foundation for the risk management process. Seven annexes provide additional guidance for applying risk assessments and potential treatments. This Standard: a) Provides guidance for establishing a risk assessment program and conducting individual risk assessments; b) Provides guidance on conducting risk assessments for risk- and resilience-based management system standards for the disciplines of risk, resilience, security, crisis, continuity, and recovery management, including principles of risk assessment, managing the risk assessment program, and conducting risk assessments, as well as evaluation of competence of persons involved in the risk assessment process; c) Describes the process for conducting risk assessments consistent with the Plan-Do-Check-Act Model; and d) Provides the informational basis necessary for decision-makers to make informed decisions about managing risks in the organization and its supply chain. This Standard is a guidance document and not intended as a specification for third-party certification. It provides a comprehensive approach to establishing a risk assessment program and the conduct of individual assessments. Implementation of this Standard should be tailored to the needs of the organization.