SP 800-39Final2011

Managing Information Security Risk: Organization, Mission, and Information System View

At a glanceDescribes an organization-wide approach to information security risk: frame it, assess it, respond to it and monitor it, at the leadership, business process and system levels. It is the big-picture companion to SP 800-30. Useful when a district formalizes who decides how much risk is acceptable.

Reading level: Practitioner
Length: 88 pages · about 45 min for the key parts
Best for: Technology directors, Superintendents and cabinet
CSF 2.0: Govern

Read it on NIST DOI 10.6028/NIST.SP.800-39 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The publication sets out a risk management cycle (frame, assess, respond, monitor) across three tiers: the organization, its mission and business processes, and individual systems. It explains how trust, culture and governance shape risk decisions and leaves detailed techniques to companion publications.

How it is organized

Chapter 1: introduction
Chapter 2: fundamentals (three-tier approach, trust and culture)
Chapter 3: the process (frame, assess, respond, monitor)
Appendices: roles, process tasks, governance models, trust models, risk response strategies

What a school district should take from it

Someone at the cabinet level should state the district's risk tolerance in plain words.
Risk responses are accept, avoid, mitigate, share or transfer. Insurance is transfer, not mitigation.

How to use it in your district

Write a one-paragraph risk tolerance statement and have the cabinet approve it.
Name who may accept risk on the district's behalf, then use the Risk register for each acceptance.
Review the top risks at least twice a year at a cabinet meeting.

Common misconceptions

Risk management is the technology department's job.: The framing and acceptance decisions sit with leadership; technology staff inform them.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.RMRisk Management Strategy
GV.RRRoles, Responsibilities, and Authorities
GV.OVOversight

Tools in the program portal

Risk registerRecord gaps leadership formally accepts, with controls and review dates
Board briefA one-page summary for your board
Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

SP 800-30 Rev. 1Conducting risk assessments
SP 800-37 Rev. 2Risk Management Framework (RMF)
IR 8286 Rev. 1Cyber risk and enterprise risk management

Citation and source

SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View. National Institute of Standards and Technology. 2011. https://doi.org/10.6028/NIST.SP.800-39.

Topics: Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.