[Nahla K. Ivy]

This is to initiate a thread for the Risk Appetite Working Group, led by Eric Chism (NTSB) and Nicole Rohloff (Xcel Energy). This group will prepare guidance, examples, tools, and templates, applying best practices in the preparation of cybersecurity risk appetite statements.

[Nahla K. Ivy]

Uploading Latest project team Work Plan (1/22/24)

Attachments:

1. Draft-ERM-Cyber-COI_-RA_-RT_Workgroup-Planning-Document_Revised-1.21.24.docx

[Eric Chism]

Testing 1 2 3

[Nicole Rohloff]

Testing

[Eric Chism]

I am uploading some of the documents previously shared with the team

Attachments:

1. 

   COSO-in-the-Cyber-Age.pdf
   

[Nahla K. Ivy]

Posting copy of the Cyber-ERM Quick Start Guide.

[Nahla K. Ivy]

Posting copy of the Cyber-ERM Quick Start Guide.

Attachments:

1. 

   ERMQSG_20240209-r1.pdf
   

[Eric Chism]

FAIR Documents from the Feb 26 RA/RT Working Group Meeting

Attachments:

1. 

   An-Introduction-to-the-FAIR-Materiality-Assessment-Model.pdf
   

2. 

   An-Introduction-to-the-Open-FAIR-Body-of-Knowledge-1.1.pdf
   

3. 

   How-to-put-Open-Fair-Risk-Analysis-Into-Action.pdf
   

4. 

   Introduction-to-the-FAIR-Controls-Analytics-Model-FAIR-CAM™_.pdf
   

[Eric Chism]

FAIR Documents from the Feb 26 RA/RT Working Group Meeting (Part II)

Attachments:

1. 

   Open-FAIR-Risk-Analysis-Example-Guide.pdf
   

2. 

   Open-FAIR-Risk-Analysis-Process-Guide.pdf
   

[Andrew Brown]

This is somewhat duplicative of the NISTIR 8286. There’s a few points of clarity that the NISTIR doesn’t address. It is very much in a draft state.

Attachments:

1. Risk_Appetite-Tolerance_Statements.docx

[Andrew Brown]

I’m listening to the CSF 2.0 briefing from NIST on the Cyber-ERM COI meeting today. Perhaps a “quick-start” guide for developing a Risk Appetite statement, a Risk tolerance statement and ultimately a Risk profile. We may be able to plagiarize… reuse the NIST quick start guide(s). Duplication of terminology, process only reinforces the documents

[Andrew Brown]

I’ve obtained permission from the original author (Lucas Everly-Commonwealth of PA) to modify this document. The original intent was to clarify/visualize the difference between appetite/tolerance and risk thresholds.

Attachments:

1. 

   Risk-Landscape.pdf
   

[Author]

Posts