Integrating Cybersecurity and Enterprise Risk Management (ERM)

Published

December 18, 2025

Author(s)

Stephen Quinn, Julie Anne Chua, Nahla Ivy, Robert Gardner, Karen Scarfone, Matthew Smith, Greg Witte

Abstract

The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise's ERM processes through communications and risk information sharing. By doing so, enterprises and their component organizations can better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. This document focuses on the use of risk registers to set out cybersecurity risk and explains the value of rolling up measures of risk that are usually addressed at lower system and organizational levels to the broader enterprise level.

Citation

NIST Interagency/Internal Report (NISTIR) - 8286r1

Report Number

8286r1

NIST Pub Series

NIST Interagency/Internal Report (NISTIR)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.IR.8286r1

Local Download

Keywords

cybersecurity risk management (CSRM), cybersecurity risk measurement, cybersecurity risk profile, cybersecurity risk register (CSRR), enterprise risk management (ERM), enterprise risk profile, enterprise risk register (ERR), risk appetite, risk tolerance.

Citation

Quinn, S. , Chua, J. , Ivy, N. , Gardner, R. , Scarfone, K. , Smith, M. and Witte, G. (2025), Integrating Cybersecurity and Enterprise Risk Management (ERM), NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8286r1, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=960491 (Accessed December 19, 2025)