Run a NIST 800-39 risk programme your board can trust
NIST SP 800-39 is NIST's guidance on managing information security risk across a whole organisation, published in March 2011 as "Managing Information Security Risk: Organization, Mission, and Information System View".
- Issued by
- NIST, Joint Task Force Transformation Initiative
- Full title
- Managing Information Security Risk: Organization, Mission, and Information System View
- Published
- March 2011
- Type
- Voluntary guidance (no certification)
Is NIST 800-39 right for your organisation?
It sets out a risk management process of four components (frame, assess, respond and monitor) applied at three tiers. It is the umbrella guidance that sits above the NIST Risk Management Framework (SP 800-37) and risk assessment guidance (SP 800-30).
US federal agencies use SP 800-39 to structure their organisation-wide information security risk programmes, and contractors and suppliers to government often adopt it to match their customers' approach. Any organisation that wants a defensible, board-level risk management process, rather than system-by-system checklists, can use it as a reference model.
Adopting it is voluntary, though customers and auditors often expect it.
How OneClickComply helps with NIST 800-39
NIST SP 800-39 is supported in OneClickComply today. The risk register, risk treatment plans and continuous monitoring support each step of the frame, assess, respond and monitor cycle, with evidence collected automatically from your connected tools. Control mapping means the same risk work also counts towards ISO 27001, SOC 2 and other NIST frameworks you follow.
Requirements covered
Four risk management components in Chapter 3 (framing, assessing, responding to and monitoring risk), broken into 12 tasks and applied across three organisational tiers.
Manual NIST 800-39 compliance vs OneClickComply
Doing it manually
- Risk tolerance and assumptions live in old slide decks nobody revisits
- Risk assessments are spreadsheets that go stale the week after they are finished
- Treatment decisions are made in meetings with no record of who agreed what
- Monitoring means chasing control owners for screenshots each quarter
- Tier 1 strategy and Tier 3 system risks never join up in one view
With OneClickComply
- Risk framing decisions are recorded once and linked to every risk
- The risk register stays current as connected tools report control status
- Each treatment plan logs the decision, owner and rationale
- Evidence is collected automatically and drift triggers an alert
- One register connects organisational, business process and system risks
Everything you need for NIST 800-39
Risk register structured around framing, assessing, responding to and monitoring risk
Recorded risk tolerance and appetite to anchor every risk decision
Risk treatment plans with owners, due dates and accept, avoid, mitigate or transfer options
Continuous monitoring with alerts when controls drift
Automated evidence collection from 13,000+ integrations
Control mapping to SP 800-53, ISO 27001 and SOC 2 so risk work counts once
Three steps to NIST 800-39 compliance
Connect and scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-39 and shows which controls pass and which fail.
Fix and generate
OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts NIST 800-39 policies from your real environment.
Monitor and evidence
Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.
See how far your current setup is from NIST 800-39.
NIST SP 800-39 requirements
The four risk management components in Chapter 3 of SP 800-39 (sections 3.1 to 3.4) and the 12 tasks within them.
| Reference | Requirement |
|---|---|
| 3.1 | Framing risk |
| TASK 1-1 | Risk assumptions |
| TASK 1-2 | Risk constraints |
| TASK 1-3 | Risk tolerance |
| TASK 1-4 | Priorities and trade-offs |
| 3.2 | Assessing risk |
| TASK 2-1 | Threat and vulnerability identification |
| TASK 2-2 | Risk determination |
| 3.3 | Responding to risk |
| TASK 3-1 | Risk response identification |
| TASK 3-2 | Risk response evaluation |
| TASK 3-3 | Risk response decision |
| TASK 3-4 | Risk response implementation |
| 3.4 | Monitoring risk |
| TASK 4-1 | Risk monitoring strategy |
| TASK 4-2 | Risk monitoring |
Always check the official text of NIST 800-39 for the exact wording.
NIST 800-39 questions, answered
Can't find what you need? Our in-house auditors can talk you through NIST 800-39 on a 30-minute call.
What is NIST SP 800-39?
NIST SP 800-39 is NIST guidance titled Managing Information Security Risk: Organization, Mission, and Information System View, published in March 2011. It describes an organisation-wide process for managing information security risk built on four components: framing risk, assessing risk, responding to risk and monitoring risk. These components are applied across three tiers: the organisation, its missions and business processes, and its information systems.
Is NIST SP 800-39 mandatory?
NIST SP 800-39 is guidance, not a law, so it is not mandatory for private organisations. US federal agencies are expected to follow NIST guidance under FISMA and OMB policy, so it shapes how government risk programmes are designed. Contractors may meet it through customer expectations. Other organisations adopt it voluntarily as a reference model for enterprise risk management.
What are the four steps of NIST 800-39?
The four components of the NIST 800-39 risk management process are frame, assess, respond and monitor. Framing sets the assumptions, constraints, risk tolerance and priorities. Assessing identifies threats and vulnerabilities and determines risk. Responding identifies, evaluates, decides on and implements a course of action. Monitoring checks that responses stay effective and tracks changes that affect risk.
What are the three tiers in NIST 800-39?
NIST 800-39 applies risk management at three tiers. Tier 1 is the organisation, where governance and the risk management strategy are set. Tier 2 is mission and business processes, where risk informs process design and enterprise architecture. Tier 3 is information systems, where controls are selected, implemented and assessed. Risk decisions and information flow between the tiers in both directions.
How does NIST 800-39 relate to the NIST RMF and SP 800-30?
NIST SP 800-39 is the top-level guidance that sets the organisation-wide risk process. SP 800-37, the Risk Management Framework, applies that process to individual information systems at Tier 3. SP 800-30 gives detailed guidance on the risk assessment component. SP 800-53 provides the security and privacy controls selected in response to identified risks.
How does NIST 800-39 compare with ISO 27001?
NIST 800-39 and ISO 27001 both require a structured, repeatable approach to information security risk, but they differ in purpose. ISO 27001 is a certifiable management system standard with mandatory clauses and Annex A controls. NIST 800-39 is non-certifiable guidance on the risk process itself. Organisations often use 800-39 thinking to strengthen the risk assessment and treatment parts of an ISO 27001 programme.
Can you get certified against NIST 800-39?
No, there is no certification for NIST SP 800-39. It is guidance that organisations use to design their risk management programme. You can show alignment by documenting your risk management strategy, keeping a current risk register, recording treatment decisions and evidencing ongoing monitoring, which auditors and customers can review as part of wider assessments such as FedRAMP, SOC 2 or ISO 27001.
Does OneClickComply support NIST SP 800-39?
Yes. NIST SP 800-39 is supported in OneClickComply today. The risk register, treatment plans, continuous monitoring and automated evidence collection support each step of the frame, assess, respond and monitor cycle, and control mapping lets the same work count towards ISO 27001 and SOC 2. Our in-house audit team is available for guidance.
Related frameworks
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · United States
- NIST SP 800-161 Rev. 1Guidance · United States
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · United States
- NIST AI 600-1 Generative AI ProfileGuidance · United States
- NIST SP 800-161 Rev. 1 Level 2 (Mission and Business Process)Guidance · United States
- NIST SP 800-160 Vol. 2 Rev. 1Guidance · United States
- NIST SP 800-82 Rev. 3 Low OT OverlayGuidance · United States
- NIST SP 800-161 Rev. 1 C-SCRM BaselineGuidance · United States
Start working towards NIST 800-39
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.