CGRC · Question #382
Which NIST publication provides guidance on the three tiers in the risk management hierarchy including Tier 1, Tier 2, and Tier 3? Response:
The correct answer is B. NIST SP 800-39. NIST SP 800-39 provides comprehensive guidance on managing information security risk across an organization, detailing a three-tiered risk management hierarchy.
Question
Which NIST publication provides guidance on the three tiers in the risk management hierarchy including Tier 1, Tier 2, and Tier 3? Response:
Options
- ANIST SP 800-37
- BNIST SP 800-39
- CNIST SP 800-30
- DNIST SP 800-137
How the community answered
(38 responses)- A3% (1)
- B92% (35)
- C5% (2)
Why each option
NIST SP 800-39 provides comprehensive guidance on managing information security risk across an organization, detailing a three-tiered risk management hierarchy.
NIST SP 800-37 focuses on the Risk Management Framework (RMF) for federal information systems, which implements risk management but doesn't primarily define the three-tier hierarchy.
NIST Special Publication 800-39, titled 'Managing Information Security Risk: Organization, Mission, and Information System View,' specifically outlines a three-tiered risk management approach. These tiers address risk from the organizational level (Tier 1), the mission/business process level (Tier 2), and the information system level (Tier 3), providing a holistic framework for enterprise-wide risk management.
NIST SP 800-30 provides guidelines for conducting risk assessments, which is a component of risk management, not the overarching three-tier hierarchy publication.
NIST SP 800-137 focuses on Information Security Continuous Monitoring (ISCM) for federal information systems and organizations, which is a separate aspect of security management.
Concept tested: NIST risk management publications
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf
Topics
Community Discussion
No community discussion yet for this question.