NIST has released Draft NISTIR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight, for public comment.
This report completes the cybersecurity risk management (CSRM) and enterprise risk management (ERM) integration cycle described throughout the NISTIR 8286 series.
Draft NISTIR 8286C describes methods for combining risk information from across the enterprise, including notional examples for aggregating and normalizing the results from cybersecurity risk registers (CSRRs) while considering risk parameters, criteria, and business impacts.
The resulting integration and normalization of risk information informs enterprise-level risk decision-making and monitoring, which helps create a comprehensive picture of the overarching cyber risk. The report describes the creation of an enterprise risk profile (ERP) that supports the comparison and management of cyber risks along with other risk types.
The public comment period is open through March 11, 2022.
