Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio | NIST SP 800-221r1 Draft Available for Comment
The initial public draft of NIST SP 800-221r1, "Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio," is now available for public comment through December 7, 20
The comment period is now open through December 7, 2026, for NIST Special Publication (SP) 800-221r1 ipd (Revision 1, initial public draft), Enterprise Impact of Information and Communications Technology (ICT) Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.
About the Publication
Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk—aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types.
Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0
NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring that ICTRM aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. The document supports organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
See the publication details for more about changes in this revision, as well as a copy of the draft and comment template.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.