United States Government Publishing Office publisher pbl distributor dst United States Commerce Department National Institute of Standards and Technology (NIST) author aut Government Organization Quinn, Stephen. author aut text government publication eng GOVPUB Executive Agency Publications executive 2023-10-27 Commerce Department 2022-02-10 monographic deposited born digital 45 digital object pages C 13. https://www.govinfo.gov/app/details/GOVPUB-C13-99071e5a8a81d82057f89709c1069c89 P0b002ee1c1bb2bf0 on1389889996 (OCoLC)1389889996 DGPO 2023-10-27 2026-06-27 GOVPUB-C13-99071e5a8a81d82057f89709c1069c89 machine generated eng fdlp C13 GOVPUB-C13-99071e5a8a81d82057f89709c1069c89 99071e5a8a81d82057f89709c1069c89 GOVPUB NIST Interagency or Internal Reports NOTE: THE “DATE ISSUED” ABOVE MAY DEFAULT TO JANUARY 1ST OF A GIVEN YEAR. TO THE VIEW THE MOST ACCURATE DATE OF ISSUE, REVIEW THE TITLE PAGE OF THE PUBLICATION. Interim or final reports on work performed by NIST for outside sponsors (both government and non-government). May also report results of NIST projects of transitory or limited interest, including those that will be published subsequently in more comprehensive form. National Institute of Standards and Technology Commerce Department. National Institute of Standards and Technology. 2022 2022-02-10 https://www.govinfo.gov/app/details/GOVPUB-C13-99071e5a8a81d82057f89709c1069c89 https://www.govinfo.gov/content/pkg/GOVPUB-C13-99071e5a8a81d82057f89709c1069c89/pdf/GOVPUB-C13-99071e5a8a81d82057f89709c1069c89.pdf Computer security Cybersecurity risk management Cybersecurity risk measurement Cybersecurity risk register (CSRR) Enterprise risk management (ERM) Key performance indicator (KPI) Key risk indicator (KRI) Risk acceptance Risk aggregation Risk avoidance Risk conditioning Risk management Risk mitigation Risk optimization Risk prioritization Risk response Risk sharing Risk transfer Quinn, Stephen. creator Quinn, Stephen. Ivy, Nahla. Barrett, Matthew. Witte, Greg. Gardner, R. K. National Institute of Standards and Technology (U.S.) Material Measurement Laboratory mdu U.S. Dept. of Commerce, National Institute of Standards and Technology 2022-02-10. monographic 1 online resource (45 pages) : illustrations (color) text technical report eng This document is the second in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional detail regarding the enterprise application of cybersecurity risk information; the previous document, NISTIR 8286A, provided detail regarding stakeholder risk guidance and risk identification and analysis. This second publication describes the need for determining the priorities of each of those risks in light of their potential impact on enterprise objectives, as well as options for properly treating that risk. This report describes how risk priorities and risk response information are added to the cybersecurity risk register (CSRR) in support of an overall enterprise risk register. Information about the selection of and projected cost of risk response will be used to maintain a composite view of cybersecurity risks throughout the enterprise, which may be used to confirm and, if necessary, adjust risk strategy to ensure mission success. Stephen Quinn; Nahla Ivy; Matthew Barrett; Greg Witte; R. K. Gardner. February 2022. Title from PDF title page (viewed January 4, 2023). Includes bibliographical references. Approved by the NIST Editorial Review Board on 2022-09-20 Mode of access: World Wide Web. Systems requirements: Adobe Acrobat PDF reader. Computer security Risk management Cybersecurity risk management Cybersecurity risk measurement Cybersecurity risk register (CSRR) Enterprise risk management (ERM) Key performance indicator (KPI) Key risk indicator (KRI) Risk acceptance Risk aggregation Risk avoidance Risk conditioning Risk mitigation Risk optimization Risk prioritization Risk response Risk sharing Risk transfer https://doi.org/10.6028/NIST.IR.8286B