New guidance on integrating cyber security and enterprise risk management

Published: Wednesday, 25 March 2020 09:48

The NIST Computer Security Resource Center (CSRC) has published a draft guidance document looking at how organizations can integrate cyber security and enterprise risk management processes.

‘Integrating Cybersecurity and Enterprise Risk Management’ has been released for public comment.

Abstract (verbatim):

The increasing frequency, creativity, and variety of cybersecurity attacks means that all enterprises should ensure cybersecurity risk is getting the appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cybersecurity risk information, which they provide as inputs to their enterprise’s ERM processes through communications and risk information sharing. By doing so, enterprises and their component organizations can better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. Focusing on the use of risk registers to set out cybersecurity risk, this document explains the value of rolling up measures of risk usually addressed at lower system and organization levels to the broader enterprise level.

Obtain the document.