NIST SP 800-39 (managing information security risk), explained

NIST SP 800-39, "Managing Information Security Risk: Organization, Mission, and Information System View," sets out how an organization should structure information security risk management across three levels at once, rather than treating it as a property of a single system. Authored by NIST's Joint Task Force Transformation Initiative and published in March 2011, its own abstract states the goal is to provide guidance for "an integrated, organization-wide program for managing information security risk to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation resulting from the operation and use of federal information systems." NIST's publication page lists it as Final, with no later revision or supersession found as of this guide's research date, and it describes the guidance as "intentionally broad-based," deliberately leaving assessment, response and monitoring detail to other NIST publications rather than duplicating them.

The three-tier risk management hierarchy

SP 800-39 organizes risk management activity into three tiers, each addressing a different scope of decision-making:

Tier	Scope	What happens here
Tier 1 — Organization	Enterprise-wide	Risk management strategy, risk tolerance, investment decisions and governance that apply across every mission and every system
Tier 2 — Mission/Business Process	A specific mission or business function	Translating Tier 1 strategy into risk management for the processes and information flows that support a given mission, including how critical a given information system is to that mission
Tier 3 — Information System	A single system	Carrying out risk decisions for a specific system's life cycle — categorization, control selection, implementation, assessment and monitoring — consistent with the risk context set by Tier 1 and Tier 2

The publication's subtitle — "Organization, Mission, and Information System View" — names exactly these three tiers. The point of the hierarchy is that a Tier 3 decision (should this system accept this risk?) should not be made in isolation from the organization's overall risk tolerance (Tier 1) or the importance of the mission the system supports (Tier 2); each tier both constrains and informs the ones below it, and risk information from Tier 3 flows back up to inform Tier 1 and Tier 2 decisions over time.

The four-component risk management process

Layered across all three tiers, SP 800-39 defines the risk management process itself as four components, intended to run continuously rather than as a one-time project:

1. Frame — establishes the context for risk-based decisions: the organization's risk assumptions, constraints, risk tolerance, and priorities that will shape how risk is assessed and treated at every tier.
2. Assess — identifies threats, vulnerabilities, likelihood of occurrence and potential impact, to determine the level of risk facing the organization, mission, or system. NIST SP 800-30 provides the detailed methodology for this component.
3. Respond — once risk has been assessed, selects and carries out an appropriate course of action (e.g., accepting, mitigating, transferring, or avoiding the risk), consistent with the risk tolerance set during Framing.
4. Monitor — verifies over time that implemented responses remain effective, and evaluates whether changes to systems, missions, or the threat environment have altered the risk picture enough to require revisiting an earlier component.

Because Monitor's findings can trigger a return to Frame, Assess, or Respond, SP 800-39 presents this as a cycle integrated into ongoing operations, not a document produced once and filed away.

How it relates to SP 800-37 and SP 800-30

SP 800-39 sits at the top of a deliberately layered set of NIST risk publications. It sets the organization-wide structure — the three tiers and the four-component process — while leaving the operational detail to publications built specifically for that purpose:

• NIST SP 800-37, the Risk Management Framework (RMF), operationalizes the Assess, Respond and Monitor components for a single Tier 3 information system through its seven steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor).
• NIST SP 800-30, Guide for Conducting Risk Assessments, provides the detailed methodology behind the Assess component specifically — identifying threat sources, threat events, vulnerabilities, likelihood and impact.
• NIST SP 800-53 supplies the control catalog that the Respond component draws from once a risk response has been selected.

Read together, SP 800-39 answers "how should risk management be structured across the organization," while SP 800-37 and SP 800-30 answer "how do we actually assess and manage risk for this system" — a device or firmware maker building an internal risk program benefits from reading SP 800-39 first to set that structure before adopting RMF-style system-level steps.

A workable starting point

1. Write down Tier 1 before building Tier 3 paperwork. An organization that jumps straight to system-level risk assessments without first agreeing on organizational risk tolerance ends up with inconsistent, uncomparable risk calls across systems.
2. Name the Tier 2 missions a given system actually supports. This is what lets a Tier 3 risk decision be weighed against mission impact, rather than evaluated as if every system mattered equally.
3. Treat Frame as a living artifact, not a one-time memo. Risk tolerance and assumptions should be revisited whenever Monitor surfaces a material change, not only when a new system is onboarded.
4. Use SP 800-39 for structure, not for assessment or control detail. When it's time to actually assess a system's risk or select controls, move to SP 800-30 and SP 800-53/SP 800-37 respectively — SP 800-39 intentionally does not duplicate that content.

SoftWSP's firmware and device security assessments produce evidence — vulnerability findings, component data, remediation status — that can feed directly into a Tier 3 risk assessment and response decision within a broader SP 800-39-style risk management program: see Device & Firmware Security.

This guide summarises NIST SP 800-39 (March 2011) and its relationship to SP 800-37 and SP 800-30; it is not a substitute for the full text and does not constitute compliance or legal advice.