Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management

Quinn, Stephen; Ivy, Nahla; Barrett, Matthew; Feldman, Larry; Witte, Gregory; Gardner, Robert

doi:https://doi.org/10.6028/NIST.IR.8286A

NISTIR 8286A

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management

Documentation Topics

Date Published: November 2021

Author(s)

Stephen Quinn (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Larry Feldman (Huntington Ingalls Industries), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)

Abstract

This document supplements NIST Interagency or Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and methods for determining risks in that context. To support the development of an Enterprise Risk Register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets. Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise risk profile helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring.

This document supplements NIST Interagency or Internal Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk... See full abstract

Keywords

cybersecurity risk management; cybersecurity risk measurement; cybersecurity risk register; enterprise risk management (ERM); enterprise risk profile

Control Families

None selected

Documentation

Publication:
NISTIR 8286A (DOI)
Local Download

Supplemental Material:
Risk Register Schema (JSON) (other)
Risk Detail Record Schema (JSON) (other)
Risk Detail Record Example (JSON) (other)

Other Parts of this Publication:
NISTIR 8286
NISTIR 8286B
NISTIR 8286C
NISTIR 8286D

Document History:
12/14/20: NISTIR 8286A (Draft)
07/06/21: NISTIR 8286A (Draft)
11/12/21: NISTIR 8286A (Final)

Topics

Security and Privacy
risk management; security measurement

Applications
enterprise