NIST SP 800-39: Managing Information Security Risk

https://www.bankinfosecurity.com/agency-releases/nist-sp-800-39-managing-information-security-risk-r-2353