The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Source(s):
NIST SP 800-12 Rev. 1 under Risk Management from NIST SP 800-39
NIST SP 800-128 under Risk Management from NIST SP 800-39
NIST SP 800-137 under Risk Management from FIPS 200 - Adapted
NIST SP 800-161 under Risk Management from CNSSI 4009 - Adapted
NIST SP 800-30 Rev. 1 under Risk Management from NIST SP 800-39, CNSSI 4009 - Adapted
NIST SP 800-39 under Risk Management from CNSSI 4009 - Adapted
NIST SP 800-53 Rev. 4 under Risk Management from CNSSI 4009 - Adapted
NISTIR 7621 Rev. 1 under Risk Management from NIST SP 800-53 Rev. 4

  The process of managing risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system. It includes risk assessment; cost-benefit analysis; the selection, implementation, and assessment of security controls; and the formal authorization to operate the system. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations.
Source(s):
NIST SP 800-18 Rev. 1 under Risk Management from NIST SP 800-30
NIST SP 800-34 Rev. 1 under Risk Management from NIST SP 800-53

  the on-going process of assessing the risk to IT resources andinformation, as part of a risk-based approach used to determine adequate security for a system, by analyzing the threats and vulnerabilities and selecting appropriate cost-effective controls to achieve and maintain an acceptable level of risk.
Source(s):
NIST SP 800-16 under Risk Management

  The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Source(s):
NIST SP 800-63-3 under Risk Management

  The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system.
Source(s):
NIST SP 800-37 Rev. 1 under Risk Management from FIPS 200 - Adapted
NIST SP 800-82 Rev. 2 under Risk Management from FIPS 200 - Adapted

  The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security and privacy state of the information system.
Source(s):
NIST SP 800-53A Rev. 4 under Risk Management from CNSSI 4009 - Adapted

  The total process of identifying, controlling, and eliminating or minimizing uncertain events that may adversely affect system resources. It includes risk analysis, cost benefit analysis, selection, implementation and test, security evaluation of safeguards, and overall security review.
Source(s):
NISTIR 4734 under Risk Management

  An ISCM capability that focuses on reducing the successful exploits of the other non-meta capabilities that occur because the risk management process fails to correctly identify and prioritize actions and investments needed to lower the risk profile.
Source(s):
NISTIR 8011 Vol. 1

  See Capability, Manage and Assess Risk.
Source(s):
NISTIR 8011 Vol. 1 under Risk (ISCM Capability)
NISTIR 8011 Vol. 1 under Risk Management

  The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.
Source(s):
NISTIR 8170 under Risk Management from CNSSI 4009 - adapted

  The process of identifying, assessing, and responding to risk.
Source(s):
NIST Cybersecurity Framework Version 1.1 under Risk Management
NIST Privacy Framework Version 1.0 under Risk Management