Integrating Cybersecurity and Enterprise Risk Management (ERM)

Quinn, Stephen; Chua, Julie; Ivy, Nahla; Gardner, Robert; Kent, Karen; Smith, Matthew; Witte, Gregory

doi:https://doi.org/10.6028/NIST.IR.8286r1

NIST IR 8286 Rev. 1

Integrating Cybersecurity and Enterprise Risk Management (ERM)

Documentation Topics

Date Published: December 2025

Supersedes: IR 8286 (10/13/2020)

Planning Note (12/18/2025):

The NIST IR 8286 series enables risk practitioners to integrate CSRM activities more fully into the broader enterprise risk processes. Because information and technology comprise some of the enterprise’s most valuable resources, it is vital that directors and senior leaders always have a clear understanding of cybersecurity risk posture. It is similarly vital that those identifying, assessing, and treating cybersecurity risk understand enterprise strategic objectives when making risk decisions.

In addition to this foundational document, the NIST Interagency Report (IR) 8286 Series includes:

NIST IR 8286Ar1, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management
- Describes risk identification and analysis.
NIST IR 8286B-upd1, Prioritizing Cybersecurity Risk for Enterprise Risk Management
- Describes methods for applying enterprise objectives to prioritize the identified risks and, subsequently, to select and apply the appropriate responses.
NIST IR 8286Cr1, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight
- Describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio.
NIST IR 8286D-upd1, Using Business Impact Analysis to Inform Risk Prioritization and Response
- Describes the identification and management of risk as it propagates from system to organization and from organization to enterprise, which in turn better informs Enterprise Risk Management deliberations. NIST IR 8286D expands typical BIA discussions to inform risk prioritization and response by quantifying the organizational impact and enterprise consequences of compromised IT Assets.

Author(s)

Stephen Quinn (NIST), Julie Chua (NIST), Nahla Ivy (NIST), Robert Gardner (New World Technology Partners), Karen Kent (Trusted Cyber Annex), Matthew Smith (Seemless Transition LLC), Gregory Witte (Palydin LLC)

Abstract

The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, shared through their enterprise’s ERM processes. By doing so, enterprises and their component organizations can better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. This document includes guidance on the use of risk registers to set out cybersecurity risk and explains the value of rolling up measures of risk that are usually addressed at lower system and organizational levels to the broader enterprise level.

Keywords

cyber risk; cybersecurity risk management (CSRM); cybersecurity risk measurement; cybersecurity risk profile; cybersecurity risk register (CSRR); enterprise risk management (ERM); enterprise risk profile; enterprise risk register (ERR); risk appetite; risk tolerance

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.8286r1
Download URL

Supplemental Material:
Risk Register Schema (JSON)
Risk Register Schema (xlsx)
Risk Detail Record Schema (JSON)
Risk Detail Record Schema (xlsx)
Risk Detail Record Example (JSON)
Risk Detail Record Example (xlsx)
OLIR Mapping NIST IR 8286 to CSF 1.1 (xlsx)
Playbook: ERM for the U.S. Federal Government (pdf)
Association for Federal Enterprise Risk Management (AFERM)
RMA - GCOR Conference
Prioritizing Cybersecurity Risk for ERM (2022 RMA GCOR Conference Session)

Publication Parts:
IR 8286A Rev. 1
IR 8286B
IR 8286C Rev. 1
IR 8286D

Related NIST Publications:
IR 8170
SP 800-161 Rev. 1
CSWP 29

Document History:
02/26/25: IR 8286 Rev. 1 (Draft)
12/18/25: IR 8286 Rev. 1 (Final)

Topics

Security and Privacy

risk management, security measurement

Applications

enterprise