Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Prioritizing Cybersecurity Risk for Enterprise Risk Management



Stephen Quinn, Matthew Barrett, Greg Witte, Robert Gardner, Nahla Ivy


This document is the second in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional detail regarding the enterprise application of cybersecurity risk information; the previous document, NISTIR 8286A, provided detail regarding stakeholder risk guidance and risk identification and analysis. This second publication describes the need for determining the priorities of each of those risks in light of their potential impact on enterprise objectives, as well as options for properly treating that risk. This report describes how risk priorities and risk response information are added to the cybersecurity risk register (CSRR) in support of an overall enterprise risk register. Information about the selection of and projected cost of risk response will be used to maintain a composite view of cybersecurity risks throughout the enterprise, which may be used to confirm and, if necessary, adjust risk strategy to ensure mission success.
NIST Interagency/Internal Report (NISTIR) - 8286B
Report Number


cybersecurity risk management, cybersecurity risk measurement, cybersecurity risk register (CSRR), enterprise risk management (ERM), key performance indicator (KPI), key risk indicator (KRI), risk acceptance, risk aggregation, risk avoidance, risk conditioning, risk mitigation, risk optimization, risk prioritization, risk response, risk sharing, risk transfer.


Quinn, S. , Barrett, M. , Witte, G. , Gardner, R. and Ivy, N. (2022), Prioritizing Cybersecurity Risk for Enterprise Risk Management, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online],, (Accessed May 28, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created February 10, 2022, Updated November 29, 2022