Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management

By: National Institute of Standards and Technology

Narrated by: Tom Brooks

All organizations face a broad array of risks, including cybersecurity risk. For federal agencies, the Office of Management and Budget (OMB) Circular A-11 defines risk as “the effect of uncertainty on objectives”. An organization’s mission and business objectives can be impacted by such effects, and must be managed at various levels within the organization. This report highlights aspects of cybersecurity risk management (CSRM) inherent to enterprises, organizations, and systems.

The terms "organization" and "enterprise" are often used interchangeably; however, without an understanding of organizational structure, effective risk management is impossible. For the purposes of this document, an organization is defined as an entity of any size, complexity, or position within a larger organizational structure. The enterprise exists at the top level of the hierarchy where senior leaders have unique risk governance responsibilities. Each enterprise, such as a corporation or government agency, is comprised of organizations supported by systems.

This report describes CSRM activities at each level. Note that there may be iterative levels within the enterprise and that positions may be relative. For example, a given enterprise (e.g., a bureau or corporate division) may represent an organization to the overarching agency or corporation. Enterprise risk management (ERM) calls for understanding the core (i.e., significant) risks that an organization faces, and this document provides supplemental guidance for aligning cyber security risks within an organization’s overall ERM program. Lessons learned from historical cybersecurity incidents demonstrate the importance of collaboration among CSRM and ERM.

PLEASE NOTE: When you purchase this title, the accompanying PDF will be available in your Audible Library along with the audio.

©2021 Tom Brooks (P)2021 Tom Brooks