Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST IR 8286A (Initial Public Draft)

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (ERM)

Date Published: December 2020
Comments Due: March 1, 2021 (public comment period is CLOSED)
Email Questions to:

Planning Note (01/13/2021): The comment period has been extended through March 1, 2021.


Kevin Stine (NIST), Stephen Quinn (NIST), Larry Feldman (Huntington Ingalls Industries), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)


This report provides a more in-depth discussion of the concepts introduced in the NISTIR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). It specifically highlights that cybersecurity risk management (CSRM) is an integral part of ERM—both taking its direction from ERM and informing it. The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their ERM programs by ensuring the CSRM program is anchored within the context of ERM. This document is intended to help individual organizations that are already familiar with NISTIR 8286.

NOTE: A call for patent claims is included on page iii of this draft.  For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.



cybersecurity risk management; cybersecurity risk measurement; cybersecurity risk profile; cybersecurity risk register; enterprise risk management (ERM); enterprise risk profile
Control Families

None selected


Download URL

Supplemental Material:
See NISTIR 8286 details for JSON files in Open Risk Register Format (ORRF)

Publication Parts:
IR 8286

Document History:
12/14/20: IR 8286A (Draft)
07/06/21: IR 8286A (Draft)
11/12/21: IR 8286A (Final)


Security and Privacy

risk management, security measurement