Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight: NIST IR 8286C

 NIST has released NIST Internal
Report (IR) 8286C,
Staging Cybersecurity Risks for Enterprise Risk Management and
Governance Oversight
. This report completes the
cybersecurity risk management (CSRM) and enterprise risk management (ERM)
integration cycle described throughout the NIST IR 8286 series.

NIST IR 8286C describes methods for combining risk information
from across the enterprise, including notional examples for aggregating and
normalizing the results from cybersecurity risk registers (CSRRs) while considering
risk parameters, criteria, and business impacts. The resulting integration and
normalization of risk information informs enterprise-level risk decision-making
and monitoring, which helps create a comprehensive picture of the overarching
cyber risk. The report describes the creation of an enterprise risk profile
(ERP) that supports the comparison and management of cyber risks along with
other risk types.

NIST IR 8286C pairs with several other reports:

The NIST IR 8286 series enables risk practitioners to integrate
CSRM activities more fully into the broader enterprise risk processes. Because
information and technology comprise some of the enterprise’s most valuable
resources, it is vital that directors and senior leaders have a clear
understanding of cybersecurity risk posture at all times. It is similarly vital
that those identifying, assessing, and treating cybersecurity risk understand
enterprise strategic objectives when making risk decisions.

The authors of the NIST IR 8286 series hope that these
publications will spark further industry discussion. As NIST continues to
develop frameworks and guidance to support the application and integration of
information and technology, many of the series’ concepts will be considered for