NIST has released NIST Internal Report (IR) 8286C, ‘Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight’. This new report completes NIST’s cyber security risk management (CSRM) and enterprise risk management (ERM) integration cycle.
NIST IR 8286C describes methods for combining risk information from across the enterprise, including notional examples for aggregating and normalizing the results from cyber security risk registers (CSRRs) while considering risk parameters, criteria, and business impacts. The resulting integration and normalization of risk information informs enterprise-level risk decision-making and monitoring, which helps create a comprehensive picture of the overarching cyber risk. The report describes the creation of an enterprise risk profile (ERP) that supports the comparison and management of cyber risks along with other risk types.
Abstract for Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight (verbatim):
This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional details regarding the enterprise application of cybersecurity risk information; the previous documents, NISTIRs 8286A and 8286B, provided details regarding stakeholder risk direction and methods for assessing and managing cybersecurity risk in light of enterprise objectives. NISTIR 8286C describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio. This cohesive understanding supports an enterprise risk register (ERR) and enterprise risk profile (ERP) that, in turn, support the achievement of enterprise objectives.
