Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

Quinn, Stephen; Ivy, Nahla; Barrett, Matthew; Witte, Gregory; Gardner, Robert

doi:https://doi.org/10.6028/NIST.IR.8286C-draft

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST IR 8286C (Initial Public Draft)

Obsoleted on September 14, 2022 by IR 8286C

Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

Documentation Topics

Date Published: January 26, 2022
Comments Due: March 11, 2022 (public comment period is CLOSED)
Email Questions to: nistir8286@nist.gov

Author(s)

Stephen Quinn (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)

Announcement

This report completes the cybersecurity risk management (CSRM) and enterprise risk management (ERM) integration cycle described throughout the NISTIR 8286 series.

Draft NISTIR 8286C describes methods for combining risk information from across the enterprise, including notional examples for aggregating and normalizing the results from cybersecurity risk registers (CSRRs) while considering risk parameters, criteria, and business impacts. The resulting integration and normalization of risk information informs enterprise-level risk decision-making and monitoring, which helps create a comprehensive picture of the overarching cyber risk. The report describes the creation of an enterprise risk profile (ERP) that supports the comparison and management of cyber risks along with other risk types.

Draft NISTIR 8286C builds on several previous reports:

NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) –foundational document that describes high-level processes
NISTIR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management – describes risk identification and analysis
NISTIR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management – describes methods for applying enterprise objectives to prioritize the identified risks and, subsequently, to select and apply the appropriate responses

The NISTIR 8286 series enables risk practitioners to integrate CSRM activities more fully into the broader enterprise risk processes. Because information and technology comprise some of the enterprise’s most valuable resources, it is vital that directors and senior leaders have a clear understanding of cybersecurity risk posture at all times. It is similarly vital that those identifying, assessing, and treating cybersecurity risk understand enterprise strategic objectives when making risk decisions.

The authors of the NISTIR 8286 series hope that these publications will spark further industry discussion. As NIST continues to develop frameworks and guidance to support the application and integration of information and technology, many of the series’ concepts will be considered for inclusion.

NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Abstract

This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This document provides additional detail regarding the enterprise application of cybersecurity risk information. The previous documents, NISTIRs 8286A and 8286B, provided detail regarding stakeholder risk direction and methods for assessing and managing cybersecurity risk in light of enterprise objectives. NISTIR 8286C describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio. This cohesive understanding supports an enterprise risk register (ERR) and enterprise risk profile (ERP) that, in turn, support the achievement of enterprise objectives.

This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This document provides additional detail regarding the enterprise application of cybersecurity risk information. The previous... See full abstract

Keywords

cybersecurity risk management; cybersecurity risk measurement; cybersecurity risk register (CSRR); enterprise risk management (ERM); key performance indicator (KPI); key risk indicator (KRI); risk acceptance; risk aggregation; risk avoidance; risk conditioning; risk mitigation; risk optimization; risk prioritization; risk response; risk sharing; risk transfer

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.8286C-draft
Download URL

Supplemental Material:
See NISTIR 8286 Supplemental Material

Other Parts of this Publication:
IR 8286
IR 8286A
IR 8286B
IR 8286D

Document History:
01/26/22: IR 8286C (Draft)
09/14/22: IR 8286C (Final)

Topics

Security and Privacy

risk management, security measurement, security programs & operations

Applications

enterprise