NIST SP 800-39

Why does it matter?

SP 800-39 is the publication that gives the rest of the NIST risk management series its shape. Section 2.1 states that managing risk requires the involvement of the entire organization, from senior leaders setting strategic goals to the individuals operating the systems, and that risk-based decision making must be integrated into every aspect of the organization. Its three tiers and four components are reused by SP 800-30 for risk assessment and by SP 800-37 for the Risk Management Framework, so an organization that adopts it has one vocabulary for risk from the boardroom to the system owner.

Key benefits include:

• Risk framed before it is assessed

Section 2.1 and Task 1-1 to Task 1-4 make the organization state its risk assumptions, constraints, tolerance and priorities and trade-offs before any assessment is run.

• A named owner for organization-wide risk

Section 2.3.2 establishes the risk executive (function) as the common risk management resource for senior leaders, mission owners, CIOs, CISOs, system owners and common control providers.

• Three tiers that inform each other

Section 2.2 ties Tier 1 priorities to the Tier 2 enterprise architecture and the Tier 3 allocation of controls, with inter-tier and intra-tier communication and a feedback loop.

• Five defined risk responses

Section 3.3 and Appendix H cover accepting, avoiding, mitigating, sharing and transferring risk, with the requirement that a decision to accept risk is consistent with the stated tolerance.

• Governance options stated

Appendix F describes centralized, decentralized and hybrid governance structures and the trade-offs of each.

How does it work?

Chapter Two sets out the fundamentals. Section 2.1 defines the four components: framing risk (establishing the context, which produces the risk management strategy), assessing risk, responding to risk and monitoring risk. Section 2.2 introduces the three-tiered approach: Tier 1 implements risk framing and provides the context for all risk management activities; the missions and business functions defined there shape the Tier 2 processes and the investment and funding decisions that drive enterprise architecture, and Tier 3 allocates and deploys management, operational and technical security controls.

Sections 2.3 to 2.5 describe each tier. The Tier 1 organization view covers governance (2.3.1), the risk executive (function) (2.3.2), the risk management strategy (2.3.3) and investment strategies (2.3.4). The Tier 2 mission/business process view covers risk-aware mission/business processes (2.4.1), enterprise architecture (2.4.2) and information security architecture (2.4.3). The Tier 3 information systems view is where the Risk Management Framework of SP 800-37 operates (2.5). Sections 2.6 to 2.8 then address trust and trustworthiness, including trust among organizations and the trustworthiness of systems, organizational culture, and the relationships among governance, risk tolerance, trust and culture.

Chapter Three is the process, with 14 tasks summarized in Appendix E. Framing (Section 3.1): identify risk assumptions (Task 1-1), constraints (1-2), risk tolerance (1-3) and priorities and trade-offs (1-4). Assessing (3.2): identify threats and vulnerabilities (2-1) and determine risk (2-2). Responding (3.3): identify alternative courses of action (3-1), evaluate them (3-2), decide (3-3) and implement (3-4). Monitoring (3.4): develop a risk monitoring strategy (4-1) and monitor systems and environments on an ongoing basis (4-2). Appendix H adds strategies for each of the five response types.

Key Elements

• Four components (Section 2.1)

Frame, assess, respond and monitor, carried out as a holistic, organization-wide activity from the strategic to the tactical level with a feedback loop for continuous improvement.

• Three tiers (Section 2.2)

Tier 1 organization, Tier 2 mission/business process and Tier 3 information system, with traceability and transparency of risk-based decisions across tiers.

• Risk executive (function) (Section 2.3.2)

A functional role, not necessarily one person, that coordinates with senior leaders to establish risk management roles and responsibilities and an organization-wide approach to risk.

• Risk management strategy (Section 2.3.3)

The Tier 1 output of risk framing: how the organization intends to assess, respond to and monitor risk, including its risk tolerance.

• Enterprise and information security architecture (Sections 2.4.2 and 2.4.3)

Tier 2 structures that embed security into mission/business processes and allocate common, hybrid and system-specific controls.

• Trust and trustworthiness (Section 2.6 and Appendix G)

How organizations establish trust with one another and judge the trustworthiness of systems, with trust models in Appendix G.

• Process tasks (Chapter Three and Appendix E)

Tasks 1-1 to 4-2 with inputs, activities and outputs for framing, assessing, responding to and monitoring risk.

• Governance and response strategies (Appendices F and H)

Centralized, decentralized and hybrid governance models; risk acceptance, avoidance, sharing and transfer, and mitigation strategies.

What does it cover?

SP 800-39 applies to managing information security risk to organizational operations (mission, functions, image and reputation), organizational assets, individuals, other organizations and the Nation arising from the operation and use of federal information systems (Section 1.1). It applies to all federal information systems other than national security systems, which may use it with the approval of officials exercising policy authority, and it is offered to state, local and tribal governments and the private sector. It is a strategic-level guide: it contains no security controls and no assessment procedures, and Section 1.1 says it is not intended to replace other risk-related programs the organization runs under other legislation, directives or policies.

What are its objectives?

Section 1.1 and Chapter Two set out what the publication is for:

Provide guidance for an integrated, organization-wide program for managing information security risk (Section 1.1).

Give a structured yet flexible approach that is intentionally broad-based, with the specifics of assessing, responding and monitoring supplied by other NIST publications (Section 1.1).

Sit within, and complement, a more comprehensive enterprise risk management program (Section 1.1).

Integrate risk-based decision making into every aspect of the organization, from senior leaders to those operating systems (Section 2.1).

Carry the risk management process across the three tiers with effective inter-tier and intra-tier communication (Section 2.2).

Establish the risk executive (function), the risk management strategy and the governance structure that give risk decisions an owner (Section 2.3).

Framework in Context

SP 800-39 is the top of the NIST risk management series. SP 800-30 Rev. 1 amplifies its assessing component with a detailed risk assessment method, and SP 800-37 Rev. 2 is the Tier 3 process named in Section 2.5 for individual systems; both reuse the three tiers and the frame, assess, respond and monitor components defined here. The CSRC record lists CSWP 3 as a related publication and no revision since 2011, so the March 2011 text remains current. Section 1.1 positions the guidance as complementary to an enterprise risk management program rather than a replacement for one.

Common Framework Mappings

NIST SP 800-39 is commonly mapped to the NIST publications that implement its tiers and to the governance and risk management frameworks that describe the same organization-wide process.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

ISO 27001:2022

ISO 27005:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2