How many tiers are there in Risk Management according to NIST SP 800-39?

• A. Two
• B. Three
• C. Four
• D. Five

Answer: (B)

The correct answer is three tiers in Risk Management according to NIST SP 800-39. This framework establishes a comprehensive approach to managing risk, where the three tiers represent different levels of risk management processes and considerations.

The first tier, known as the organizational tier, involves the strategic level of risk management that focuses on the organization’s overall risk management strategy and policies. This tier ensures that risk management is integrated into the organization's mission, strategy, and operations.

The second tier is the mission/business process tier, which addresses risks associated directly with specific missions or business processes. This tier is crucial because it aligns risk management efforts with the operational aspect of the organization, ensuring that specific processes are effectively managed in terms of risk.

The third tier is the information system tier, which focuses on managing risks at the level of individual information systems. This tier involves direct implementation of controls and risk mitigation strategies for specific systems, ensuring that any vulnerabilities are addressed appropriately.

This three-tiered approach facilitates a holistic view of risk management across different levels of the organization, allowing for tailored risk assessments and responses that align with both organizational goals and operational necessities.