Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

Published

September 14, 2022

Author(s)

Stephen Quinn, Nahla Ivy, Greg Witte, Matthew Barrett, Robert Gardner

Abstract

This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional details regarding the enterprise application of cybersecurity risk information; the previous documents, NISTIRs 8286A and 8286B, provided details regarding stakeholder risk direction and methods for assessing and managing cybersecurity risk in light of enterprise objectives. NISTIR 8286C describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio. This cohesive understanding supports an enterprise risk register (ERR) and enterprise risk profile (ERP) that, in turn, support the achievement of enterprise objectives.

Citation

NIST Interagency/Internal Report (NISTIR) - 8286C

Report Number

8286C

NIST Pub Series

NIST Interagency/Internal Report (NISTIR)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.IR.8286C

Local Download

Keywords

cybersecurity risk management, cybersecurity risk measurement, cybersecurity risk register (CSRR), enterprise risk management (ERM), key performance indicator (KPI), key risk indicator (KRI), risk acceptance, risk aggregation, risk avoidance, risk conditioning, risk mitigation, risk optimization, risk prioritization, risk response, risk sharing, risk transfer.

Citation

Quinn, S. , Ivy, N. , Witte, G. , Barrett, M. and Gardner, R. (2022), Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8286C, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=935103 (Accessed February 19, 2025)