Date Published: December 2020
Comments Due:
Email Questions to:
Planning Note (1/13/2021):
The comment period has been extended through March 1, 2021.
Author(s)
Kevin Stine (NIST), Stephen Quinn (NIST), Larry Feldman (Huntington Ingalls Industries), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)
Announcement
This report provides a more in-depth discussion of the concepts introduced in the NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). It specifically highlights that cybersecurity risk management (CSRM) is an integral part of ERM—both taking its direction from ERM and informing it. The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their ERM programs by ensuring the CSRM program is anchored within the context of ERM. This document is intended to help individual organizations that are already familiar with NISTIR 8286.
NOTE: A call for patent claims is included on page iii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
This document supplements NIST Interagency/Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and methods for determining risks in that context. To support development of an enterprise risk register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets. Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise cybersecurity risk profile, helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring.
This document supplements NIST Interagency/Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk...
See full abstract
This document supplements NIST Interagency/Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and methods for determining risks in that context. To support development of an enterprise risk register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets. Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise cybersecurity risk profile, helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring.
Hide full abstract
Keywords
cybersecurity risk management; cybersecurity risk measurement; cybersecurity risk profile; cybersecurity risk register; enterprise risk management (ERM); enterprise risk profile
Control Families
None selected
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
