Risk Management Strategy

Risk Management Strategy template: The organization-wide strategy for how the organization frames, assesses, responds to and monitors security and privacy risk, including its risk tolerance, following NIST SP 800-39 and RMF Prepare task P-2.

Type	Program stage	Status	Template version	NIST basis
Plan	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The organization-wide strategy for how the organization frames, assesses, responds to and monitors security and privacy risk, including its risk tolerance, following NIST SP 800-39 and RMF Prepare task P-2.

Controls satisfied

Control	Title
PM-9	Risk Management Strategy
PM-28	Risk Framing
PM-29	Risk Management Program Leadership Roles
PM-31	Continuous Monitoring Strategy

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

Preview (annotated)

Guidance

In NIST SP 800-39 (March 2011, current as of September 2026), risk framing “produces a risk management strategy that addresses how organizations intend to assess risk, respond to risk, and monitor risk” (section 3.1). The sections below follow its four components: frame, assess, respond and monitor. RMF task P-2 in SP 800-37 Rev. 2 asks for the same strategy, “that includes a determination of risk tolerance”. Its discussion lists what the strategy includes: risk tolerance, acceptable risk assessment methodologies and risk response strategies, a process for evaluating risk consistently across the organization, and approaches for monitoring risk over time. Every authorization decision should be traceable to this document, so write the risk tolerance so that an authorizing official can apply it.

Organization	Strategy version	Approved by	Approval date	Next review
Organization name	Fill in: version	Senior leader	Fill in: date	Fill in: date

1. Purpose and scope

This strategy sets out how Organization name manages security risk to its operations and assets, individuals, other organizations and the Nation from operating and using its systems (PM-9a.1), and privacy risk to individuals from its authorized processing of personally identifiable information (PM-9a.2). It applies across the organization, and every system’s risk decisions follow it (PM-9b).

Supply chain risk is managed under the supply chain risk management strategy (PM-30), which follows the risk tolerance set here.

2. Governance

Role	Part in risk management
Senior leader	Approves this strategy and sets risk tolerance (PM-28a.4)
Senior accountable official for risk management	Aligns security and privacy risk management with strategic, operational and budget planning (PM-29a)
Risk executive (function)	Reviews risk across the organization, resolves conflicts between units, and keeps decisions consistent (PM-29b). Members: Fill in: members. Meets Fill in: how often
Chief Information Security Officer	Maintains this strategy and runs the processes in it
Senior privacy official	Assesses and advises on privacy risk
Authorizing officials	Accept risk for their systems within the tolerance in section 3.3
System owner	Assesses and responds to risk for the system, and proposes risk acceptance

3. Risk framing

Guidance

Framing is the context every other risk decision uses: SP 800-39 tasks 1-1 to 1-4. Keep each entry short and specific. “We assume attackers will target our public web services” is useful; “we take threats seriously” is not.

3.1 Assumptions

The assumptions that affect how Organization name assesses, responds to and monitors risk (PM-28a.1):

Topic	Assumption
Threat sources	Fill in: who is likely to attack or disrupt the organization, for example criminal groups seeking ransom, insiders, suppliers, natural hazards
Vulnerabilities and conditions	Fill in: for example reliance on a few cloud providers, legacy systems that cannot be patched quickly
Consequences	Fill in: the harms that matter most, for example loss of service to customers, disclosure of personal data
Likelihood	Fill in: how likelihood is judged, for example from incident history, threat intelligence and sector reports

3.2 Constraints

The constraints on risk assessment, response and monitoring (PM-28a.2): Fill in: for example budget limits, laws and contracts, legacy technology, staffing, supplier contracts.

3.3 Risk tolerance

Guidance

Risk tolerance is the level of risk the organization will accept in pursuit of its mission. Say it per risk level and per impact type, and say who must be consulted before each level is accepted. Tie the levels to the scale in section 4, so an assessed risk maps straight to a decision.

Only the authorizing official accepts risk for an authorized system: SP 800-37 Rev. 2, task R-3, says “the authorizing official is the only person who can accept risk.” The system owner proposes; the authorizing official decides. Task R-4 has the authorizing official consult the senior accountable official for risk management or the risk executive (function) before the authorization decision. Use the table to say who else to consult for higher risks, rather than moving the acceptance to them.

The Senior leader sets the organization’s risk tolerance as follows (PM-28a.4). For an authorized system, the authorizing official accepts risk at every level, after consulting the roles named for that level:

Assessed risk level	Tolerance	Consult before accepting	Conditions
Very high	Fill in: for example not accepted; the system does not operate until the risk is reduced	Fill in: role, for example the risk executive (function) and the senior leader	Fill in: conditions
High	Fill in: for example accepted only for a limited time with a plan of action	Fill in: role, for example the risk executive (function)	Fill in: for example no longer than 90 days
Moderate	Fill in: tolerance	Fill in: role, for example the CISO	Fill in: conditions
Low	Fill in: tolerance	Fill in: role, for example none; reported in the risk register	Fill in: conditions
Very low	Fill in: tolerance	Fill in: role, for example none; reported in the risk register	Fill in: conditions

Additional statements of tolerance: Fill in: for example no tolerance for loss of personal data of more than a set number of individuals; no single outage of a mission-essential service longer than a set time.

3.4 Priorities and trade-offs

The priorities and trade-offs Organization name considers in managing risk (PM-28a.3): Fill in: for example mission-essential services before internal services; availability of patient-facing systems weighed against speed of patching.

3.5 Distribution

The Chief Information Security Officer shall distribute the results of risk framing, this section, to Fill in: the personnel to receive the results of risk framing activities Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management. (PM-28b)

4. Risk assessment

Guidance

Name one methodology and one scale for the whole organization, so risks from different systems can be compared. NIST SP 800-30 Rev. 1 (September 2012) is the usual reference for the method; SP 800-39 calls this component threat and vulnerability identification (task 2-1) and risk determination (task 2-2).

Item	Approach
Methodology	Fill in: for example NIST SP 800-30 Rev. 1, tailored as described here
Scale	Fill in: for example five qualitative levels, very low to very high, for likelihood, impact and risk
How likelihood and impact combine	Fill in: for example the risk matrix in an appendix
Threat information	Fill in: sources, for example the threat awareness program (PM-16), sector sharing groups, vendor advisories
Organization-level assessment	Fill in: how often the organization-wide risk assessment is done, and by whom
System-level assessments	Each system follows RA-3 and the risk assessment policy, using this methodology and scale
Privacy risk	Fill in: how privacy risk is assessed, for example through privacy impact assessments

5. Risk response

Guidance

SP 800-39 splits response into identifying responses, evaluating alternatives, deciding and implementing (tasks 3-1 to 3-4). Assessors check that accepted risks were accepted by someone allowed to accept them, so keep the record in section 5.3.

5.1 Response options

For each risk above the tolerance in section 3.3, the system owner proposes one of these responses: accept, avoid, mitigate, share or transfer. The proposal evaluates the alternatives for cost, effectiveness and effect on the mission.

5.2 Decisions

The authorizing official decides the response, after consulting the roles named in section 3.3 for the assessed risk level. Mitigations are tracked in the system’s plan of action and milestones (CA-5), within the organization’s plan of action and milestones process (PM-4).

5.3 Record of accepted risk

Each risk acceptance is recorded with the risk, its level, the reason, the compensating measures, the person who accepted it and an expiry date, in Fill in: where accepted risks are recorded, for example the risk register.

6. Risk monitoring

Risk is monitored under the continuous monitoring strategy (PM-31), which sets the metrics, frequencies and reporting. These events trigger a new assessment of the affected risk: Fill in: for example a significant change to a system, a major incident, a new threat or vulnerability affecting the organization, a change in law or mission.

7. Approval

Name	Title	Signature	Date
Fill in: name	Senior leader		Fill in: date

8. Review and change history

• The Chief Information Security Officer shall review and update this strategy Fill in: the frequency at which to review and update the risk management strategy Typical: annually, and whenever organizational changes require it. (PM-9c)
• The Chief Information Security Officer shall review and update the risk framing in section 3 Fill in: the frequency for reviewing and updating risk framing considerations Typical: annually, with this strategy. (PM-28c)

Version	Date	Change	Approved by
Fill in: version	Fill in: date	Fill in: summary of change	Fill in: name and title

Federal systems

OMB Circular A-130, Appendix I, section 3.a, requires agencies to implement “an agency-wide risk management process that frames, assesses, responds to, and monitors information security and privacy risk on an ongoing basis across the three organizational tiers.” Its footnote points to SP 800-39 and to section 5. Section 5.b, in the discussion of major provisions, says the risk management strategy “describes how an agency intends to assess risk, respond to risk, and monitor risk,” and that a credible strategy identifies risk assumptions, constraints, tolerance, and priorities and trade-offs.

• This strategy shall describe how the agency carries out the agency-wide risk management process that OMB Circular A-130, Appendix I, section 3.a, requires, and shall state the risk assumptions, constraints, tolerance, and priorities and trade-offs that section 5.b describes. (PM-9)