NIST has released NIST Internal Report (IR) 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight. This report completes the cybersecurity risk management (CSRM) and enterprise risk management (ERM) integration cycle described throughout the NIST IR 8286 series.
NIST IR 8286C describes methods for combining risk information from across the enterprise, including notional examples for aggregating and normalizing the results from cybersecurity risk registers (CSRRs) while considering risk parameters, criteria, and business impacts. The resulting integration and normalization of risk information informs enterprise-level risk decision-making and monitoring, which helps create a comprehensive picture of the overarching cyber risk. The report describes the creation of an enterprise risk profile (ERP) that supports the comparison and management of cyber risks along with other risk types.
NIST IR 8286C pairs with several other reports:
- NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM) - foundational document that describes high-level processes
- NIST IR 8286A, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management - describes risk identification and analysis
- NIST IR 8286B, Prioritizing Cybersecurity Risk for Enterprise Risk Management - describes methods for applying enterprise objectives to prioritize the identified risks and, subsequently, to select and apply the appropriate responses
- NIST IR 8286D, Using Business Impact Analysis to Inform Risk Prioritization and Response - describes how business impact analysis (BIA) can help review impact on enterprise assets, including expansion of BIA aspects to include confidentiality and integrity, in addition to existing availability considerations.
The NIST IR 8286 series enables risk practitioners to integrate CSRM activities more fully into the broader enterprise risk processes. Because information and technology comprise some of the enterprise's most valuable resources, it is vital that directors and senior leaders have a clear understanding of cybersecurity risk posture at all times. It is similarly vital that those identifying, assessing, and treating cybersecurity risk understand enterprise strategic objectives when making risk decisions.
The authors of the NIST IR 8286 series hope that these publications will spark further industry discussion. As NIST continues to develop frameworks and guidance to support the application and integration of information and technology, many of the series' concepts will be considered for inclusion.
