Approaches for federal agencies to use the cybersecurity framework

Abstract

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Advancing Cybersecurity and Enterprise Risk Management (ERM):

“…The Circular emphasizes the need to integrate and coordinate risk management and strong and effective internal control into existing business activities and as an integral part of managing an agency." [4]…”

“…3 (See Section 2.2.4 for more information on what systems are.) For example, NIST IR 8170 [4] uses enterprise risk management and organization-wide risk management interchangeably. The scope of IR 8170 includes smaller enterprises than this publication does, so an enterprise as defined in IR 8170 may be comprised of a single organization.…”

“…The goal is to help the personnel in those enterprises and their subordinate organizations and systems to better identify, assess, and manage their cybersecurity risks in the context of their broader mission and business objectives. 4 This document will help 296 high-level executives and corporate officers understand the challenges cybersecurity 297 professionals face in providing them the information they are accustomed to getting for other 298 types of risk. This document also will help cybersecurity professionals to understand what 299 executives and corporate officers need to carry out enterprise risk management (ERM).…”

“…1 [8]) 7 "OMB Circular A-123 establishes an expectation for federal agencies to proactively consider and address risks through an integrated, organization-level view of events, conditions, or scenarios that impact mission achievement." [4] influenced by legal or regulatory requirements. [7] Risk appetite is usually defined at the enterprise or organizational level, while risk tolerance is usually defined at the system level.…”

“…[7] Risk appetite is usually defined at the enterprise or organizational level, while risk tolerance is usually defined at the system level. 9 [4]…”