Integrating Cybersecurity and Enterprise Risk Management (ERM)

Stine, Kevin; Quinn, Stephen; Witte, Gregory; Gardner, Robert

doi:https://doi.org/10.6028/NIST.IR.8286

NISTIR 8286

Integrating Cybersecurity and Enterprise Risk Management (ERM)

Documentation Topics

Date Published: October 2020

Author(s)

Kevin Stine (NIST), Stephen Quinn (NIST), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)

Abstract

The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM processes through communications and risk information sharing. By doing so, enterprises and their component organizations can better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. Focusing on the use of risk registers to set out cybersecurity risk, this document explains the value of rolling up measures of risk usually addressed at lower system and organization levels to the broader enterprise level.

Keywords

cybersecurity risk management (CSRM); cybersecurity risk measurement; cybersecurity risk profile; cybersecurity risk register (CSRR); enterprise risk management (ERM); enterprise risk profile; risk appetite; risk tolerance

Control Families

None selected

Documentation

Publication:
NISTIR 8286 (DOI)
Local Download

Supplemental Material:
Risk Register Schema (JSON) (other)
Risk Detail Record Schema (JSON) (other)
Risk Detail Record Example (JSON) (other)
OLIR Mapping NISTIR 8286 to Cybersecurity Framework v1.1 (xls)
Playbook: Enterprise Risk Management for the U.S. Federal Government (pdf)
Association for Federal Enterprise Risk Management (AFERM) (web)
RMA - GCOR Conference (web)
2022 RMA GCOR Conference Session: Prioritizing Cybersecurity Risk for Enterprise Risk Management (other)

Other Parts of this Publication:
NISTIR 8286A
NISTIR 8286B
NISTIR 8286C
NISTIR 8286D (Draft)

Related NIST Publications:
NISTIR 8170
SP 800-161 Rev. 1
White Paper NIST CSWP 6

Document History:
03/19/20: NISTIR 8286 (Draft)
07/09/20: NISTIR 8286 (Draft)
10/13/20: NISTIR 8286 (Final)

Topics

Security and Privacy
risk management

Applications
enterprise