The comment period is now open through December 7, 2026, for NIST Special Publication (SP) 800-221r1 ipd (Revision 1, initial public draft), Enterprise Impact of Information and Communications Technology (ICT) Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.
About the Publication
Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk—aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types.
Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0
NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring that ICTRM aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. The document supports organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
See the publication details for more about changes in this revision, as well as a copy of the draft and comment template.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
