Managing Information Security Risk

NIST Special Publication 800-39

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.

This publication may be used by nongovernmental organizations on a voluntary basis and is not
subject to copyright in the United States

see NIST Special Publication 800-39 clicking here