After the system is developed, NIST talk about risk management in the operational maintenance phase of the enterprise architecture. They focus the risk management on security. I think their main concern is security threat. I also think they didn't spend a lot of time describe other risks like system failure, functional, performance, integrity, compliance which are very important and many of them can get political.