Key concepts
The publication explains how separate technology risk programs can share a common life cycle and feed one enterprise risk register and portfolio, including positive risk (opportunities). SP 800-221A provides an outcomes framework, organized like the CSF, for checking whether those programs are governed and integrated.
How it is organized
- Technology risk management and the challenges of integrating it with ERM
- Risk considerations: context, identify, analyze, prioritize, respond, monitor, positive risk
- Building enterprise registers and portfolios from technology-specific registers
- Enterprise strategy for coordinating technology risk
- Companion: SP 800-221A, the ICT Risk Outcomes Framework
What a school district should take from it
- Privacy, vendor, AI and cybersecurity risks are related; one register avoids gaps and duplicate work.
- Technology decisions also carry opportunity, which belongs in the same discussion.
How to use it in your district
- Combine cyber, privacy and vendor risks in one cabinet-level list.
- Use the 800-221A outcomes as a checklist for how well those programs are coordinated.
- Assign each technology risk area an owner who reports to the same leadership meeting.
Common misconceptions
- Technology risk equals cybersecurity risk.
- It also covers privacy, supply chain, AI and operational risks from technology.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.RMRisk Management Strategy
- GV.OVOversight
Tools in the program portal
- Risk registerRecord gaps leadership formally accepts, with controls and review dates
- Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
- Vendor RegistryKnow which vendors hold district data
Related publications
- IR 8286 Rev. 1Cyber risk and enterprise risk management
- SP 1303CSF 2.0 and enterprise risk management
Citation and source
SP 800-221, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio. National Institute of Standards and Technology. 2023. https://doi.org/10.6028/NIST.SP.800-221.
Topics: Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.