800-39 has replaced 800-30 as the authoritative source of comprehensive risk management guidance.

• A. True
• B. False
• C. Not applicable
• D. Cannot be determined

Answer: (A)

This is true because NIST Special Publication 800-39 provides the overarching, organization-wide approach to information security risk management, integrating governance, risk assessment, risk response, and monitoring into a single, comprehensive framework. It positions risk management as an enterprise process, guiding how to frame, assess, respond to, and monitor risks across the entire organization. SP 800-30, by contrast, focuses specifically on risk assessment methodologies for identifying and evaluating risks, not the full governance and management lifecycle. So while 800-30 is still a valuable companion for risk assessment, 800-39 is the authoritative source for comprehensive risk management guidance.