Risk management is a basic component of cyber security and information protection. Different contours and standards are designed to guide organizations in effective management of risks. The most acclaimed ISO/IEC 27005 and NIST RISK Management Infrastructure (RMF), especially NIST SP 800-30 Chapter 1. This report provides a detailed comparison between these two risk management approaches.