Which tier in NIST SP 800-39 corresponds to 'Information Systems'?

• A. Tier 1
• B. Tier 2
• C. Tier 3
• D. Tier 4

Answer: (C)

The correct answer is that 'Information Systems' corresponds to Tier 3 in NIST SP 800-39. This tier focuses on the implementation of risk management practices at the operational level, which includes information systems. At Tier 3, organizations are expected to manage risk through a detailed understanding of their information systems and their specific risks. This tier emphasizes the importance of incorporating security controls, monitoring activities, and incident handling as integral parts of the information systems' lifecycle.

By addressing how risks are managed within the context of specific information systems, organizations can ensure that tactics and strategies are tailored to the particular risks associated with those systems. This tier allows stakeholders to connect enterprise risk management practices with day-to-day operations, including the management of individual information systems, ensuring compliance and providing security measures against threats.

Understanding this framework is essential for implementing effective IT security measures, as it helps delineate responsibilities and processes across different tiers of an organization's risk management approach.