thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

NIST SP 800-39

NIST guidance on managing information security risk at organization, mission, and system tiers.

Definition

SP 800-39 defines a risk management process of framing, assessing, responding to, and monitoring risk. It describes three tiers: organization (governance), mission/business process, and information system. It provides the umbrella under which the RMF and SP 800-30 operate.

Example

An agency's risk executive function sets risk tolerance at Tier 1 that guides system-level decisions at Tier 3.

Exam tip

Remember frame, assess, respond, monitor and the three tiers.

Related terms