NIST SP 800-39 — Managing Information Security Risk: Organization, Mission, and Information System View

Overview

NIST SP 800-39 is a risk management publication from NIST providing guidance for managing information security risk at the organizational, mission/business process, and information system levels. It establishes a comprehensive risk management framework that integrates security risk management into organizational governance and operations.

Published by NIST, SP 800-39 is used by federal agencies, senior leaders, risk executives, and information security professionals to establish structured approaches to managing risks to organizational operations and assets. It covers organizational risk framing, risk assessment, risk response, and risk monitoring activities.

Organizations implement SP 800-39 by establishing risk management governance structures, defining risk framing approaches, conducting risk assessments at multiple organizational levels, implementing risk responses, and monitoring ongoing risk posture.

Why it Matters

NIST SP 800-39 provides federal agencies with a comprehensive, multi-level approach to information security risk management that integrates security into organizational governance and decision-making.

Key benefits include:

• Establish enterprise risk management

Create integrated risk management across organizational, mission, and system levels supporting informed governance decisions.

• Support federal compliance

Meet FISMA and federal requirements for information security risk management across agency programs.

• Improve risk-informed decisions

Provide leadership with risk information needed to make informed investment and operational decisions.

• Integrate with RMF

Establish the organizational risk management context for NIST Risk Management Framework implementation.

• Manage organizational risk posture

Maintain ongoing awareness and management of information security risk across agency operations.

How it Works

SP 800-39 establishes four risk management components: risk framing (establishing risk context), risk assessment (identifying threats and vulnerabilities), risk response (selecting and implementing responses), and risk monitoring (maintaining awareness of risk posture). These operate across organizational, mission/business, and information system tiers.

Key Elements

• Risk Framing Component

Establishes organizational risk context, tolerance, and constraints guiding risk management activities.

• Risk Assessment Component

Identifies threats, vulnerabilities, and potential impacts to inform risk response decisions.

• Risk Response Component

Selects and implements risk responses including acceptance, avoidance, mitigation, and sharing.

• Risk Monitoring Component

Maintains ongoing awareness of risk posture through continuous monitoring activities.

Framework Scope

NIST SP 800-39 applies to federal agencies managing information security risk across organizational operations, assets, individuals, and missions.

Framework Objectives

NIST SP 800-39 provides comprehensive guidance for managing information security risk across organizational levels.

• Establish integrated information security risk management across organizational tiers
• Support federal FISMA compliance through structured risk management processes
• Provide leadership with risk information for governance and investment decisions
• Integrate organizational risk management with NIST RMF implementation
• Maintain ongoing risk monitoring supporting adaptive risk response

Common Framework Mappings

Mapped frameworks include:

NIST Cybersecurity Framework

NIST SP 800-30

NIST SP 800-37

NIST SP 800-53

ISO/IEC 27001