Skip to main content

IR 8286 Rev. 1Final2025

Integrating Cybersecurity and Enterprise Risk Management (ERM)

At a glanceExplains how cybersecurity risks should flow into the risk picture leaders already manage, using cybersecurity risk registers that roll up into an enterprise risk register. Revision 1 aligns the series with CSF 2.0. It suits superintendents and business officials who want cyber risk discussed alongside other district risks.

Reading level
Practitioner
Length
78 pages · about 45 min for the key parts
Best for
Superintendents and cabinet, Business officials, Technology directors
CSF 2.0
Govern
Read it on NIST DOI 10.6028/NIST.IR.8286r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

IR 8286 Rev. 1 is the anchor of a five-part series. Part A covers identifying and estimating risk, Part B prioritizing and choosing responses, Part C combining risk registers for leadership oversight, and Part D using business impact analysis. Rev. 1 puts more weight on governance and matches CSF 2.0 terms. NIST also publishes risk register templates.

  • Cybersecurity risk register (CSRR) rolls up to an enterprise risk register
  • Risk appetite (broad) and risk tolerance (specific, measurable)
  • Responses: accept, avoid, transfer, mitigate

How it is organized

  • Gaps in managing cybersecurity risk as an input to ERM
  • Cybersecurity risk considerations throughout the ERM process
  • Cybersecurity risk management as part of a portfolio view
  • Appendices: notional cybersecurity risk register and enterprise risk register
  • Companion volumes: IR 8286A Rev. 1, IR 8286B (update 1), IR 8286C Rev. 1, IR 8286D (update 1)

What a school district should take from it

  • A short, shared risk register is the most practical bridge between the technology team and the cabinet.
  • State risk tolerance specifically, for example how long the district can run without the student information system.

How to use it in your district

  1. Keep a cybersecurity risk register with an owner, likelihood, impact and response for each entry.
  2. Bring the top entries to the cabinet's risk discussion each quarter.
  3. Record accepted risks with compensating controls and a review date in the Risk register.
  4. Use NIST's template if your business office already keeps an enterprise risk list.

Common misconceptions

A risk register is a list of everything that could go wrong.
It is a short, maintained list of the risks that matter, each with an owner and a decision.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.RMRisk Management Strategy
  • GV.OVOversight

Tools in the program portal

  • Risk registerRecord gaps leadership formally accepts, with controls and review dates
  • Board briefA one-page summary for your board
  • Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

Citation and source

IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management (ERM). National Institute of Standards and Technology. 2025. https://doi.org/10.6028/NIST.IR.8286r1.

Replaces: IR 8286 (2020, withdrawn 2025-12-18).

Topics: Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.