Integrating Cybersecurity and Enterprise Risk Management (NISTIR 8286)
I was reading the article from NIST on integrating cybersecurity with risk management and found it a great fit to a project i am working on. I made some notes on some key points from the really long article.
NISTIR 8286 is a publication by the National Institute of Standards and Technology (NIST) that provides guidelines for integrating cybersecurity risk management into an organization’s overall Enterprise Risk Management (ERM) strategy. The publication emphasizes the importance of treating cybersecurity risks as a component of an organization’s overall risk management approach, rather than as a separate and distinct concern.
The report outlines a six-step process for integrating cybersecurity and ERM:
- Establishing the context: This involves identifying the organization’s business objectives and the risks that could impact those objectives.
- Identifying risks: This step involves identifying and assessing the cybersecurity risks that could impact the organization’s objectives.
- Assessing the severity of risks: This step involves determining the severity of the identified risks in order to prioritize them for mitigation.
- Identifying cybersecurity controls: This step involves identifying and selecting cybersecurity controls to mitigate the identified risks.
- Assessing the effectiveness of controls: This step involves assessing the effectiveness of the selected cybersecurity controls to ensure that they are reducing the identified risks.
- Monitoring the overall risk posture: This step involves monitoring the organization’s overall risk posture to ensure that it remains aligned with its business objectives.
The report also provides examples of how organizations can apply the six-step process in practice, as well as a set of key principles for integrating cybersecurity and ERM.Overall, NISTIR 8286 serves as a valuable resource for organizations looking to enhance their risk management practices by integrating cybersecurity considerations.
