- This topic has 3 replies, 2 voices, and was last updated 6 months, 1 week ago by
.
-
Posts
-
-
NIST has recently published some key guidance documents related to integration of cybersecurity risk management with enterprise-wide risk management at the agency level. The COI played a key role in advancing dialogue and best practices in this area in 2020.
The NISTIR 8286 – Integrating Cybersecurity and Enterprise Risk Management (ERM), October 2020, was written for both ERM and IT practitioners to consider when establishing governance and reporting processes for cybersecurity (and information security risks) to inform agency level risk decisions. NIST expanded this publication through publication of a subseries with additional “how to” guidance on using the cybersecurity risk register as a method to identify and assess risks in this functional domain, then translate those risks to inform broader, agency level ERM programs.
NIST previously published the NISTIR 8170 – Approaches for Federal Agencies to Use the Cybersecurity Framework, March 2020, which provides eight example approaches for federal agencies to integrate the NIST CSF into existing risk management work done for FISMA compliance. Among those approaches is Item #1: Integrate enterprise and cybersecurity risk management.
Please see attachments for more.
-
-
Posting the Final IR 8286 Part D – Using Business Impact Analysis to Inform Risk Prioritization and Response (published November 2022).
The final document included input from the Cyber-ERM COI and federal agencies to NIST’s initial public draft.
Attachments:
-
Posting the new NIST SP 800-221 and accompanying SP 800-221A.
NIST SP 800-221, Enterprise Impact of Information and Communications Technology Risk; Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio, November 2023
NIST SP 800-221A, Information and Communications Technology (ICT) Risk Outcomes; Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio, November 2023
These documents extend the foundational concepts established in the NIST IR 8286 Series (Parts A-D), into the broader ICT approach to risk management. Together, the IR 8286 series and the SPO 800-221 series, addresses how to better integrate cybersecurity and related ICT risks into the broader enterprise risk discussions and decisions within government agencies, private entities, and non-profit organizations.
Attachments:
-
- You must be logged in to reply to this topic.