NIST 800-39: Three-Tier Security Risk Management

NIST Special Publication 800-39 is the US National Institute of Standards and Technology’s guidance for running an organization-wide program that manages information security risk. It does not list controls or tests. It sets out how an organization frames risk, assesses it, responds to it and monitors it, and at which of three levels (organization, mission/business process, information system) each of those decisions is made. This guide describes it as presented on the official NIST page and in the publication itself, both checked on 2026-10-29.

What NIST SP 800-39 is and who publishes it

NIST SP 800-39 is titled Managing Information Security Risk: Organization, Mission, and Information System View. The Joint Task Force Transformation Initiative authored it and NIST published it in March 2011. The NIST Computer Security Resource Center lists it with the status Final, and the page shows no withdrawal or supersession notice as described on the official page on 2026-10-29. The publication DOI is 10.6028/NIST.SP.800-39.

The document calls itself the flagship document in the series of information security standards and guidelines that NIST developed in response to the Federal Information Security Management Act (FISMA). Its stated purpose is to provide guidance for an integrated, organization-wide program for managing information security risk to organizational operations (mission, functions, image and reputation), organizational assets, individuals, other organizations and the Nation, arising from the operation and use of federal information systems.

It is intentionally broad. The publication says the specific details of assessing, responding to and monitoring risk on an ongoing basis are provided by other supporting NIST standards and guidelines, and that it is complementary to, and should be used as part of, a more comprehensive enterprise risk management (ERM) program.

Who it applies to

SP 800-39 is written for federal information systems and the organizations that run them. It does not create a certification, an audit scheme or a registry, and the publication page does not describe one. The document names a diverse target audience rather than one compliance role:

Oversight roles, such as heads of agencies, chief executive officers and chief operating officers.
Mission and business owners, information owners and stewards, and authorizing officials.
Acquisition, procurement and contracting officials.
Chief information officers, senior information security officers, information system owners and common control providers.

For a university or other research organization the document is a reference model, not a rulebook. Mapping its tiers onto an institution (for example, leadership and a research-security committee at the top tier, research units and shared facilities in the middle, individual systems and data repositories at the bottom) is an interpretation by CASRAI, not text from NIST. Where federal funding agreements or other regulations impose their own requirements, those documents, not SP 800-39, define what is mandatory. Related reading on this site: FISMA compliance.

What it requires: four components across three tiers

SP 800-39 organizes risk management into four components that repeat on an ongoing basis: risk framing, risk assessment, risk response and risk monitoring. The same document applies those components at three tiers.

The four components

Frame. Produce a risk management strategy that addresses how the organization intends to assess risk, respond to risk and monitor risk. Risk tolerance is determined during framing and defined in that strategy.
Assess. Identify and evaluate risk. The publication leaves the method to supporting documents; see the SP 800-30 row below.
Respond. Choose how to deal with assessed risk. The publication lists the response types as accepting, avoiding, mitigating, sharing or transferring risk.
Monitor. The publication gives three aims: verify that planned response measures are implemented and requirements are satisfied; determine the ongoing effectiveness of response measures; and identify risk-impacting changes to systems and their environments of operation.

The three tiers

Tier	View	What the publication assigns to it
Tier 1	Organization	Implements the first component, risk framing. Examples of Tier 1 activities that affect the lower tiers include selecting common controls, providing guidance from the risk executive (function) to authorizing officials and setting the order of recovery for systems that support critical missions.
Tier 2	Mission/business process	Defines and prioritizes mission/business processes and the information those processes need, including how critical that information is. It is informed by Tier 1 and can feed information back to it.
Tier 3	Information system	Covers categorizing systems, allocating security controls, and managing the selection, implementation, assessment, authorization and ongoing monitoring of controls. It is guided by the risk context and decisions of Tiers 1 and 2.

The direction matters: guidance and risk decisions flow down from Tier 1, while results and feedback flow back up. The publication also says organizations must consider external relationships such as suppliers, customers, partners and service providers, with particular attention to the supply chain.

Compliance steps: applying it in practice

Because SP 800-39 is guidance, there is no official application form or sign-off. The sequence below is CASRAI’s reading of the four components as an order of work, not a NIST checklist.

Write down the risk frame: what you are protecting, who decides, and the risk tolerance. The publication says this is captured in a risk management strategy.
Name the Tier 1 decision makers, including a risk executive (function) that gives guidance to authorizing officials. The publication describes the risk executive as a functional role, not necessarily one person.
Identify mission/business processes and the information they depend on, and rank them (Tier 2).
For each information system, categorize it, allocate controls and authorize operation within the frame set above (Tier 3).
Run assessments using the supporting NIST documents, choose a response for each assessed risk, and monitor against the three aims listed above.
Feed monitoring results back to the higher tiers so the frame can change.

Appendix E of the publication contains the detailed risk management process tasks; use it alongside the main text if you are building a formal program.

Typical phases

SP 800-39 does not prescribe durations, so any calendar is local to the organization. CASRAI’s reading of the four components and three tiers suggests these overlapping phases: establishing the framing and governance at Tier 1; defining priorities at Tier 2; applying system-level controls and authorization at Tier 3; and continuous monitoring with feedback upward. Treat the cycle as ongoing, not a project with an end date.

Common mistakes

Treating it as a control checklist. The publication is intentionally broad-based and defers detail to other NIST documents.
Replacing enterprise risk management with it. The document says it is complementary to, and should be part of, a broader ERM program.
Skipping risk tolerance at framing. Tolerance is determined during framing and recorded in the risk management strategy; later response decisions depend on it.
Working only at Tier 3. Control selection without organizational and mission context ignores two of the three tiers.
Monitoring only for implementation. Monitoring also covers whether response measures remain effective and whether systems or environments have changed.
Using SP 800-30 as the risk management source. A footnote in SP 800-39 states that it supersedes the original SP 800-30 for guidance on risk management; the publication says SP 800-30 was being revised to provide guidance on risk assessment as a supporting document.

Related NIST publications

The publication lists these Joint Task Force documents as supporting the unified information security framework for the federal government. Titles below are as given in SP 800-39; check each publication’s page for its current edition and status.

Publication	Role in relation to SP 800-39
SP 800-30, Guide for Conducting Risk Assessments	Supports the risk assessment component. See NIST SP 800-30 on this site.
SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems	The Risk Management Framework, which SP 800-39 says operates primarily at Tier 3 while interacting with Tiers 1 and 2.
SP 800-53, Recommended Security Controls for Federal Information Systems and Organizations	The source of security control baselines used when allocating controls.
SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations	Supports assessing the controls that were selected and implemented.

For a comparison point outside the federal framework, see ISO 27001 for research data security, and for the financial-controls side of federal awards see internal controls and federal grant compliance.

FAQ

Is NIST 800-39 still current?

The NIST publication page lists SP 800-39 as Final, published March 2011, with no withdrawal or supersession notice, as described on the official page on 2026-10-29.

Is it a certifiable standard?

No certification scheme is described on the publication page or in the document. It is guidance for building a risk management program.

Does it apply outside federal agencies?

It was written for federal information systems and is framed around FISMA. Other organizations can use its structure voluntarily, but the document does not make it a requirement for them.