Date Published: February 26, 2025
Comments Due:
Email Comments to:
Author(s)
Stephen Quinn (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Larry Feldman (Huntington Ingalls Industries), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)
Announcement
The NIST Interagency Report (IR) 8286 series of publications helps practitioners better understand the close relationship between cybersecurity and enterprise risk management (ERM). All five publications in the series have been updated to align more closely with the Cybersecurity Framework (CSF) 2.0 and other updated NIST guidance. The updated series puts greater emphasis on cybersecurity governance to highlight the importance of ensuring cybersecurity capabilities support the broader mission through ERM.
The five updated IR 8286 series publications are:
- NIST IR 8286r1 (Revision 1) initial public draft (ipd), Integrating Cybersecurity and Enterprise Risk Management (ERM) — This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM processes through communications and risk information sharing.
- NIST IR 8286Ar1 ipd, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management — This document details the context, scenario identification, and analysis of the likelihood and impacts of cybersecurity risk.
- NIST IR 8286B-upd1 (Update 1), Prioritizing Cybersecurity Risk for Enterprise Risk Management — This document describes ways to apply risk analysis to help prioritize cybersecurity risk, evaluate and select appropriate risk responses, and communicate risk activities as part of an enterprise cybersecurity risk management strategy.
- NIST IR 8286Cr1 ipd, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight — This document describes processes for aggregating information from CSRM activities throughout the enterprise.
- NIST IR 8286D-upd1, Using Business Impact Analysis to Inform Risk Prioritization and Response — This document describes considerations for documenting and analyzing business impacts that result in a full or partial loss of the confidentiality, integrity, or availability of a mission-essential resource.
NOTE: A call for patent claims is included in the front matter of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
This document supplements NIST Interagency Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and methods for determining risks in that context. To support the development of an Enterprise Risk Register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets. Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise risk profile helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring. This document has been updated to reflect changes in other NIST documentation (IR 8286 series, SP 800-221/221A, and Cybersecurity Framework 2.0).
This document supplements NIST Interagency Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and...
See full abstract
This document supplements NIST Interagency Report 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM), by providing additional detail regarding risk guidance, identification, and analysis. This report offers examples and information to illustrate risk tolerance, risk appetite, and methods for determining risks in that context. To support the development of an Enterprise Risk Register, this report describes documentation of various scenarios based on the potential impact of threats and vulnerabilities on enterprise assets. Documenting the likelihood and impact of various threat events through cybersecurity risk registers integrated into an enterprise risk profile helps to later prioritize and communicate enterprise cybersecurity risk response and monitoring. This document has been updated to reflect changes in other NIST documentation (IR 8286 series, SP 800-221/221A, and Cybersecurity Framework 2.0).
Hide full abstract
Keywords
cybersecurity risk management; cybersecurity risk measurement; cybersecurity risk register; enterprise risk management (ERM); enterprise risk profile
Control Families
None selected
