Integrating Cybersecurity and Enterprise Risk Management (ERM)

Stine, Kevin; Quinn, Stephen; Witte, Gregory; Gardner, Robert

doi:https://doi.org/10.6028/NIST.IR.8286

NIST IR 8286

Integrating Cybersecurity and Enterprise Risk Management (ERM)

Documentation Topics

Date Published: October 2020

Planning Note (08/18/2023):

In addition to this foundational document, the NIST Interagency Report (IR) 8286 Series includes:

NIST IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management – describes risk identification and analysis
NIST IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management – describes methods for applying enterprise objectives to prioritize the identified risks and, subsequently, to select and apply the appropriate responses
NIST IR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight – describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio.
NIST IR 8286D, Using Business Impact Analysis to Inform Risk Prioritization and Response – describes the identification and management of risk as it propagates from system to organization and from organization to enterprise, which in turn better informs Enterprise Risk Management deliberations. NIST IR 8286D expands typical BIA discussions to inform risk prioritization and response by quantifying the organizational impact and enterprise consequences of compromised IT Assets.

The NIST IR 8286 series enables risk practitioners to integrate CSRM activities more fully into the broader enterprise risk processes. Because information and technology comprise some of the enterprise’s most valuable resources, it is vital that directors and senior leaders always have a clear understanding of cybersecurity risk posture. It is similarly vital that those identifying, assessing, and treating cybersecurity risk understand enterprise strategic objectives when making risk decisions.

Author(s)

Kevin Stine (NIST), Stephen Quinn (NIST), Gregory Witte (Huntington Ingalls Industries), Robert Gardner (New World Technology Partners)

Abstract

The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM processes through communications and risk information sharing. By doing so, enterprises and their component organizations can better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. Focusing on the use of risk registers to set out cybersecurity risk, this document explains the value of rolling up measures of risk usually addressed at lower system and organization levels to the broader enterprise level.

Keywords

cybersecurity risk management (CSRM); cybersecurity risk measurement; cybersecurity risk profile; cybersecurity risk register (CSRR); enterprise risk management (ERM); enterprise risk profile; risk appetite; risk tolerance

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.8286
Download URL

Supplemental Material:
Risk Register Schema (JSON)
Risk Register Schema (JSON) (XSLS) (xlsx)
Risk Detail Record Schema (JSON)
Risk Detail Record Schema (JSON) (XSLS) (xlsx)
Risk Detail Record Example (JSON)
Risk Detail Record Example (JSON) (XSLS) (xlsx)
OLIR Mapping NISTIR 8286 to Cybersecurity Framework v1.1 (xlsx)
Playbook: Enterprise Risk Management for the U.S. Federal Government (pdf)
Association for Federal Enterprise Risk Management (AFERM)
RMA - GCOR Conference
2022 RMA GCOR Conference Session: Prioritizing Cybersecurity Risk for Enterprise Risk Management

Publication Parts:
IR 8286A
IR 8286B
IR 8286C
IR 8286D

Related NIST Publications:
IR 8170
SP 800-161 Rev. 1
CSWP 6
SP 800-161 Rev. 1 (Draft)

Document History:
03/19/20: IR 8286 (Draft)
07/09/20: IR 8286 (Draft)
10/13/20: IR 8286 (Final)

Topics

Security and Privacy

risk management

Applications

enterprise