Revision Now Available for Public Comment!
Enterprise Impact of Information and Communications Technology (ICT) Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio
 The comment period is now open for NIST Special Publication (SP) 800-221r1 ipd (Revision 1, Initial Public draft), Enterprise Impact of Information and Communications Technology (ICT) Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio. The comment period closes December 7, 2026.
About the Publication
Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk—aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types.
Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0
NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.01 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring that ICTRM aligns with enterprise strategy and receives appropriate oversight and resources from senior leadership. The document supports organizations of all sizes and sectors in implementing governance outcomes that connect ICT risk management with the six-core CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Additional Updates in Revision 1
- The US Office of Management and Budget (OMB) has more fully integrated enterprise risk management (ERM) into daily federal agency operations. In 2026, OMB updated its guidance as published in OMB Circular A-1232, and changes to that publication are reflected in SP 800-221r1 IPD.
- Sections were updated to better reflect important aspects of ERM, including risk culture, risk capacity, and comprehensive risk assessment.
- Enhanced alignment with the recently updated NIST Interagency Report (IR) 8286r1, Integrating Cybersecurity and Enterprise Risk Management3.
- It now includes making risk-informed workforce decisions using the risk register, as discussed in NIST SP 1308, NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide4.
- Recognition for multiple ways to quantify risk both within and in aggregate of the many risk disciplines that comprise ICTRM.
Submit Your Feedback
The comment period for NIST SP 800-221r1 ipd is open through December 7, 2026, at 11:59 PM. Submit comments to ictrm@nist.gov using the comment template.
Related References
1 NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0
2 Office of Management and Budget OMB Circular No. A-123, Management’s Responsibility for Internal Control
3 NIST Interagency Report (IR) 8286r1, Integrating Cybersecurity and Enterprise Risk Management (ERM)
4 NIST SP 1308, NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide
NIST Cybersecurity and Privacy Program
Questions and comments can be directed to: ictrm@nist.gov
CSRC Website questions: csrc-inquiry@nist.gov
|
