Draft NISTIR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management, is now available for public comment. This report continues an in-depth discussion of the concepts introduced in NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), with a focus on the use of enterprise objectives to prioritize, optimize, and respond to cybersecurity risks.

The NISTIR 8286 series of documents is intended to help organizations better implement cybersecurity risk management (CSRM) as an integral part of ERM – both taking its direction from ERM and informing it. The increasing frequency, creativity, and severity of cybersecurity attacks mean that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their ERM programs and that the CSRM program is anchored within the context of ERM.

This publication draws upon processes and templates described in NISTIR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (ERM), and on feedback received on public comment drafts of that report. Draft NISTIR 8286B extends the use of stakeholders’ risk appetite and risk tolerance statements to define risk expectations. It further describes the use of the risk register and risk detail report templates to communicate and coordinate activity.

Since enterprise resources are nearly always limited, and must also fund other enterprise risks, it is vital that CSRM work at all levels be coordinated and prioritized to maximize effectiveness and to ensure that the most critical needs are adequately addressed. Risk prioritization, risk response, and risk aggregation should be aggregated and optimized to help guide enterprise risk communication and decision-making. Through effective prioritization and response, based on accurate risk analysis in light of business objectives, managers throughout the enterprise will be able to navigate a changing risk landscape and take advantage of innovation opportunities.

A third companion document, NISTIR 8286C, which will detail processes for enterprise-level aggregation and oversight of cybersecurity risks, is being developed and will be available for review and comment in the coming months.

The public comment period for this draft is open through October 15, 2021. See the publication details for a copy of the draft and instructions for submitting comments.

NOTE: A call for patent claims is included on page iii of this draft.  For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.