GovWhitePapers Logo

Sorry, your browser is not compatible with this application. Please use the latest version of Google Chrome, Mozilla Firefox, Microsoft Edge or Safari.

Prioritizing Cybersecurity Risk for Enterprise Risk Management

This document is the second in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional detail regarding the enterprise application of cybersecurity risk information; the previous document, NISTIR 8286A, provided detail regarding stakeholder risk guidance and risk identification and analysis.

This second publication describes the need for determining the priorities of each of those risks in light of their potential impact on enterprise objectives, as well as options for properly treating that risk. This report describes how risk priorities and risk response information are added to the cybersecurity risk register (CSRR) in support of an overall enterprise risk register. Information about the selection of and projected cost of risk response will be used to maintain a composite view of cybersecurity risks throughout the enterprise, which may be used to confirm and, if necessary, adjust risk strategy to ensure mission success.

  • Author(s):
  • Kevin Stine
  • Matthew Barrett
  • Stephen Quinn
  • Greg Witte
  • Nahla Ivy
  • R. K. Gardner
  • Share this:
  • Share on Facebook
  • Share on Twitter
  • Share via Email
  • Share on LinkedIn
Prioritizing Cybersecurity Risk for Enterprise Risk Management
Format:
  • White Paper
Topics:
Website:Visit Publisher Website
Publisher:U.S. Department of Commerce
Published:September 1, 2021
License:Public Domain

Featured Content

Contact Publisher

Claim Content