# Risk Management Strategy

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/plans/risk-management-strategy/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** In [NIST SP 800-39](https://csrc.nist.gov/pubs/sp/800/39/final) (March 2011, current as of September 2026), risk framing "produces a risk management strategy that addresses how organizations intend to assess risk, respond to risk, and monitor risk" (section 3.1). The sections below follow its four components: frame, assess, respond and monitor. RMF task P-2 in [SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final) asks for the same strategy, "that includes a determination of risk tolerance". Its discussion lists what the strategy includes: risk tolerance, acceptable risk assessment methodologies and risk response strategies, a process for evaluating risk consistently across the organization, and approaches for monitoring risk over time. Every authorization decision should be traceable to this document, so write the risk tolerance so that an authorizing official can apply it.

| Organization | Strategy version | Approved by | Approval date | Next review |
| --- | --- | --- | --- | --- |
| [Organization name] | [Fill in: version] | [Senior leader] | [Fill in: date] | [Fill in: date] |

## 1. Purpose and scope

This strategy sets out how [Organization name] manages security risk to its operations and assets, individuals, other organizations and the Nation from operating and using its systems (PM-9a.1), and privacy risk to individuals from its authorized processing of personally identifiable information (PM-9a.2). It applies across the organization, and every system's risk decisions follow it (PM-9b).

Supply chain risk is managed under the supply chain risk management strategy (PM-30), which follows the risk tolerance set here.

## 2. Governance

| Role | Part in risk management |
| --- | --- |
| [Senior leader] | Approves this strategy and sets risk tolerance (PM-28a.4) |
| Senior accountable official for risk management | Aligns security and privacy risk management with strategic, operational and budget planning (PM-29a) |
| Risk executive (function) | Reviews risk across the organization, resolves conflicts between units, and keeps decisions consistent (PM-29b). Members: [Fill in: members]. Meets [Fill in: how often] |
| [Chief Information Security Officer] | Maintains this strategy and runs the processes in it |
| [Senior privacy official] | Assesses and advises on privacy risk |
| Authorizing officials | Accept risk for their systems within the tolerance in section 3.3 |
| [System owner] | Assesses and responds to risk for the system, and proposes risk acceptance |

## 3. Risk framing

> **Guidance:** Framing is the context every other risk decision uses: SP 800-39 tasks 1-1 to 1-4. Keep each entry short and specific. "We assume attackers will target our public web services" is useful; "we take threats seriously" is not.

### 3.1 Assumptions

The assumptions that affect how [Organization name] assesses, responds to and monitors risk (PM-28a.1):

| Topic | Assumption |
| --- | --- |
| Threat sources | [Fill in: who is likely to attack or disrupt the organization, for example criminal groups seeking ransom, insiders, suppliers, natural hazards] |
| Vulnerabilities and conditions | [Fill in: for example reliance on a few cloud providers, legacy systems that cannot be patched quickly] |
| Consequences | [Fill in: the harms that matter most, for example loss of service to customers, disclosure of personal data] |
| Likelihood | [Fill in: how likelihood is judged, for example from incident history, threat intelligence and sector reports] |

### 3.2 Constraints

The constraints on risk assessment, response and monitoring (PM-28a.2): [Fill in: for example budget limits, laws and contracts, legacy technology, staffing, supplier contracts].

### 3.3 Risk tolerance

> **Guidance:** Risk tolerance is the level of risk the organization will accept in pursuit of its mission. Say it per risk level and per impact type, and say who must be consulted before each level is accepted. Tie the levels to the scale in section 4, so an assessed risk maps straight to a decision.
>
> Only the authorizing official accepts risk for an authorized system: [SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final), task R-3, says "the authorizing official is the only person who can accept risk." The system owner proposes; the authorizing official decides. Task R-4 has the authorizing official consult the senior accountable official for risk management or the risk executive (function) before the authorization decision. Use the table to say who else to consult for higher risks, rather than moving the acceptance to them.

The [Senior leader] sets the organization's risk tolerance as follows (PM-28a.4). For an authorized system, the authorizing official accepts risk at every level, after consulting the roles named for that level:

| Assessed risk level | Tolerance | Consult before accepting | Conditions |
| --- | --- | --- | --- |
| Very high | [Fill in: for example not accepted; the system does not operate until the risk is reduced] | [Fill in: role, for example the risk executive (function) and the senior leader] | [Fill in: conditions] |
| High | [Fill in: for example accepted only for a limited time with a plan of action] | [Fill in: role, for example the risk executive (function)] | [Fill in: for example no longer than 90 days] |
| Moderate | [Fill in: tolerance] | [Fill in: role, for example the CISO] | [Fill in: conditions] |
| Low | [Fill in: tolerance] | [Fill in: role, for example none; reported in the risk register] | [Fill in: conditions] |
| Very low | [Fill in: tolerance] | [Fill in: role, for example none; reported in the risk register] | [Fill in: conditions] |

Additional statements of tolerance: [Fill in: for example no tolerance for loss of personal data of more than a set number of individuals; no single outage of a mission-essential service longer than a set time].

### 3.4 Priorities and trade-offs

The priorities and trade-offs [Organization name] considers in managing risk (PM-28a.3): [Fill in: for example mission-essential services before internal services; availability of patient-facing systems weighed against speed of patching].

### 3.5 Distribution

The [Chief Information Security Officer] shall distribute the results of risk framing, this section, to [Fill in: the personnel to receive the results of risk framing activities. Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management]. (PM-28b)

## 4. Risk assessment

> **Guidance:** Name one methodology and one scale for the whole organization, so risks from different systems can be compared. NIST SP 800-30 Rev. 1 (September 2012) is the usual reference for the method; SP 800-39 calls this component threat and vulnerability identification (task 2-1) and risk determination (task 2-2).

| Item | Approach |
| --- | --- |
| Methodology | [Fill in: for example NIST SP 800-30 Rev. 1, tailored as described here] |
| Scale | [Fill in: for example five qualitative levels, very low to very high, for likelihood, impact and risk] |
| How likelihood and impact combine | [Fill in: for example the risk matrix in an appendix] |
| Threat information | [Fill in: sources, for example the threat awareness program (PM-16), sector sharing groups, vendor advisories] |
| Organization-level assessment | [Fill in: how often the organization-wide risk assessment is done, and by whom] |
| System-level assessments | Each system follows RA-3 and the risk assessment policy, using this methodology and scale |
| Privacy risk | [Fill in: how privacy risk is assessed, for example through privacy impact assessments] |

## 5. Risk response

> **Guidance:** SP 800-39 splits response into identifying responses, evaluating alternatives, deciding and implementing (tasks 3-1 to 3-4). Assessors check that accepted risks were accepted by someone allowed to accept them, so keep the record in section 5.3.

### 5.1 Response options

For each risk above the tolerance in section 3.3, the system owner proposes one of these responses: accept, avoid, mitigate, share or transfer. The proposal evaluates the alternatives for cost, effectiveness and effect on the mission.

### 5.2 Decisions

The authorizing official decides the response, after consulting the roles named in section 3.3 for the assessed risk level. Mitigations are tracked in the system's plan of action and milestones (CA-5), within the organization's plan of action and milestones process (PM-4).

### 5.3 Record of accepted risk

Each risk acceptance is recorded with the risk, its level, the reason, the compensating measures, the person who accepted it and an expiry date, in [Fill in: where accepted risks are recorded, for example the risk register].

## 6. Risk monitoring

Risk is monitored under the continuous monitoring strategy (PM-31), which sets the metrics, frequencies and reporting. These events trigger a new assessment of the affected risk: [Fill in: for example a significant change to a system, a major incident, a new threat or vulnerability affecting the organization, a change in law or mission].

## 7. Approval

| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Senior leader] | | [Fill in: date] |

## 8. Review and change history

- The [Chief Information Security Officer] shall review and update this strategy [Fill in: the frequency at which to review and update the risk management strategy. Typical: annually], and whenever organizational changes require it. (PM-9c)
- The [Chief Information Security Officer] shall review and update the risk framing in section 3 [Fill in: the frequency for reviewing and updating risk framing considerations. Typical: annually, with this strategy]. (PM-28c)

| Version | Date | Change | Approved by |
| --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: summary of change] | [Fill in: name and title] |

### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 3.a, requires agencies to implement "an agency-wide risk management process that frames, assesses, responds to, and monitors information security and privacy risk on an ongoing basis across the three organizational tiers." Its footnote points to SP 800-39 and to section 5. Section 5.b, in the discussion of major provisions, says the risk management strategy "describes how an agency intends to assess risk, respond to risk, and monitor risk," and that a credible strategy identifies risk assumptions, constraints, tolerance, and priorities and trade-offs.

- This strategy shall describe how the agency carries out the agency-wide risk management process that OMB Circular A-130, Appendix I, section 3.a, requires, and shall state the risk assumptions, constraints, tolerance, and priorities and trade-offs that section 5.b describes. (PM-9)