Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

Publication Title: Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

Publication Number: NIST IR; NIST interagency report; NIST internal report; 8286C

Subject: Computer security
Risk management
Cybersecurity risk management
Cybersecurity risk measurement
Cybersecurity risk register (CSRR)
Enterprise risk management (ERM)
Key performance indicator (KPI)
Key risk indicator (KRI)
Risk acceptance
Risk aggregation
Risk avoidance
Risk conditioning
Risk mitigation
Risk optimization
Risk prioritization
Risk response
Risk sharing
Risk transfer

Government Author: Commerce Department, National Institute of Standards and Technology (NIST) .

Abstract: This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional details regarding the enterprise application of cybersecurity risk information; the previous documents, NISTIRs 8286A and 8286B, provided details regarding stakeholder risk direction and methods for assessing and managing cybersecurity risk in light of enterprise objectives. NISTIR 8286C describes how information, as recorded in cybersecurity risk registers (CSRRs), may be integrated as part of a holistic approach to ensuring that risks to information and technology are properly considered for the enterprise risk portfolio. This cohesive understanding supports an enterprise risk register (ERR) and enterprise risk profile (ERP) that, in turn, support the achievement of enterprise objectives.