Issue link: https://www.e-digitaleditions.com/i/1472963
July/August/September 2022 I 33 By doing so, enterprises and their component organiza- tions can better identify, assess, and manage their cyber- security risks in the context of their broader mission and business objectives. Focusing on the use of risk registers to set out cybersecurity risk, this document explains the value of rolling up measures of risk usually addressed at lower system and organization levels to the broader enterprise level." Furthermore, the Executive Summary from this document reads as follows: "All types of organizations, from corporations to federal agencies, face a broad array of risks. For federal agencies, the Office of Management and Budget (OMB) Circular A-11 defines risk as the effect of uncertainty on objectives." "The effect of uncertainty on enterprise mission and business objectives may then be considered an enterprise risk that must be similarly managed. An enterprise is an organization that exists at the top level of a hierarchy with unique risk management responsibilities. Managing risks at that level is known as enterprise risk management (ERM) and calls for understanding the core risks that an enterprise faces, determining how best to address those risks, and ensuring that the necessary actions are taken. In the Federal Government, ERM is considered an effective agency-wide approach to addressing the full spectrum of the organization's significant risks by under- standing the combined impact of risks as an interrelated portfolio rather than addressing risks only within silos." Cybersecurity risk is an important type of risk for any enterprise. Other risks include but are not limited to financial, legal, legislative, operational, privacy, reputa- tional, safety, strategic, and supply chain risks. As part of an ERM program, senior leaders (e.g., corporate officers, government senior executive staff) often have fiduciary and reporting responsibilities that other organizational stakeholders do not, so they have a unique responsibility to holistically manage the combined set of risks, including cybersecurity risk. The organizations/departments that comprise every enterprise are experiencing an increase in the frequency, creativity, and severity of cybersecurity attacks. All organi- zations and enterprises, regardless of size or type, should ensure that cybersecurity risks receive appropriate attention as they carry out their ERM functions. Since enterprises are at various degrees of maturity regarding the implementation of risk management, this document offers NIST's cybersecurity risk management (CSRM) expertise to help organizations improve the cybersecurity risk information they provide as inputs to their ERM programs. Many resources, such as well-known frameworks from the Committee of Sponsoring Organizations (COSO), OMB circulars, and ISO, document ERM frame- works and processes. They generally include similar approaches (e.g., identify context, identify risks, analyze risk, estimate risk importance, determine and execute the risk response, and identify and respond to changes over time). A critical risk document used to track and communicate risk information for all of these steps throughout the enterprise is called a risk register. The risk register provides a formal communication vehicle for sharing and coordinating cybersecurity risk activi- ties as an input to ERM decision makers. For example, cybersecurity risk registers are key aspects of managing and communicating about those particular risks. At higher levels in the enterprise structure, those cybersecurity and other risk registers are aggregated, normalized, and prioritized into risk profiles. A risk profile is defined by OMB Circular A-123 as "a priori- tized inventory of the most significant risks identified and assessed through the risk assessment process versus a complete inventory of risks." While it is critical that enterprises address potential negative impacts on mis- sion and business objectives, it is equally critical (and required for federal agencies) that enterprises plan for success. The OMB states in Circular A-123 that "the [Enterprise Risk] profile must identify sources of uncertainty, both positive (opportunities) and negative (threats)." Enterprise-level decision makers use the risk profile to choose which enterprise risks to address, allocate resources, and delegate responsibilities to appropriate risk owners. Furthermore, ERM programs should define termi- nology, formats, criteria, and other guidance for risk inputs from lower levels of the enterprise. Cybersecurity risk inputs to ERM programs should be documented and tracked in written cybersecurity risk registers that comply with the guidance of the ERM program.