Date Published: October 22, 2026
Comments Due:
Email Comments to:
Author(s)
Stephen Quinn (NIST), Julie Chua (NIST), Daniel Eliot (NIST), Nahla Ivy (NIST), Matthew Barrett (CyberESI Consulting Group), Larry Feldman (Huntington Ingalls Industries), Daniel Topper (Huntington Ingalls Industries), R. Gardner (New World Technology Partners), Karen Kent (Trusted Cyber Annex), Gregory Witte (Palydin LLC)
Announcement
Submit Your Feedback
The public comment period is open through December 7, 2026, at 11:59 PM EST. We encourage you to use this comment template when preparing and submitting your response.
About the Publication
Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk—aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types.
Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0
NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring that ICTRM aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. The document supports organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six-core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Additional Updates in Revision 1
- The US Office of Management and Budget (OMB) has more fully integrated enterprise risk management (ERM) into daily federal agency operations. In 2026, OMB updated its guidance as published in OMB Circular A-123, and changes to that publication are reflected in SP 800-221r1 IPD.
- Sections were updated to better reflect important aspects of ERM, including risk culture, risk capacity, and comprehensive risk assessment.
- Enhanced alignment with the recently updated NIST Interagency Report (IR) 8286r1, Integrating Cybersecurity and Enterprise Risk Management (ERM).
- It now includes making risk-informed workforce decisions using the risk register, as discussed in NIST SP 1308, NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide.
- Recognition for multiple ways to quantify risk both within and in aggregate of the many risk disciplines that comprise ICTRM.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
All enterprises should ensure that information and communications technology (ICT) risk receives appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their ICT risk management (ICTRM) in alignment with the NIST Cybersecurity Framework (CSF) 2.0. This can enable enterprises and their component organizations to better identify, assess, and manage their ICT risks in the context of their broader mission and business objectives. This document explains the value of integrating risks that may be addressed at lower system and organizational levels to the broader enterprise level by focusing on the use of ICT risk registers as input to the enterprise risk profile. Consistent with CSF 2.0’s Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities to ensure that ICT risk management aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. These guidelines support organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
All enterprises should ensure that information and communications technology (ICT) risk receives appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their ICT risk management (ICTRM) in...
See full abstract
All enterprises should ensure that information and communications technology (ICT) risk receives appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their ICT risk management (ICTRM) in alignment with the NIST Cybersecurity Framework (CSF) 2.0. This can enable enterprises and their component organizations to better identify, assess, and manage their ICT risks in the context of their broader mission and business objectives. This document explains the value of integrating risks that may be addressed at lower system and organizational levels to the broader enterprise level by focusing on the use of ICT risk registers as input to the enterprise risk profile. Consistent with CSF 2.0’s Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities to ensure that ICT risk management aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. These guidelines support organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Hide full abstract
Keywords
enterprise risk management (ERM); enterprise risk profile (ERP); enterprise risk register (ERR); information and communications technology (ICT); ICT risk; ICT risk management (ICTRM); ICT risk measurement; risk appetite; risk register; risk tolerance
Control Families
None selected
