nist -網(wǎng)絡(luò)安全框架 2.0：企業(yè)風(fēng)險(xiǎn)管理快速入門指南 NIST Cybersecurity Framework 2.0 - Enterprise Risk Management Quick-Start Guide

NIST

Enterprise

CybersecurityFramework2.0:

RiskManagement

Quick-StartGuide

U.S.DepartmentofCommerce

GinaM.Raimondo,Secretary

NationalInstituteofStandardsandTechnology

LaurieE.Locascio,NISTDirectorandUnderSecretaryofCommerceforStandardsandTechnology

NISTSpecialPublicationNISTSP1303

/10.6028/NIST.SP.1303

Pleasesendyourcommentsto

cyberframework@.

October2024

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

ThisguideprovidesanintroductiontousingtheNISTCybersecurityFramework(CSF)2.0forplanningandintegratinganenterprise-wideprocessforcybersecurityriskmanagementinformation,asasubsetofinformationandcommunicationstechnologyriskmanagement,intoenterpriseriskmanagement.TheuseofCSF

commonlanguageandoutcomessupportstheintegrationofriskmonitoring,evaluation,andadjustmentacrossvariousorganizationalunitsandprograms.

EnterpriseRiskManagement(ERM)

Whenweusethewordenterpriseinanorganizationalcontext,wemeanallaspectsofthatorganization,spanningtheentirebreadthanddepthofthatorgchart.ERMexistsatthetopleveloftheorganizationalhierarchyandspansriskconsiderationssuchasmission,financial,reputation,andtechnicalrisksthereof.ERMcallsforunderstandingthecorerisksthatanenterprisefaces,determininghowbesttoaddressthoserisks,andensuringthatthenecessaryactionsaretaken.AnERMprogramallowsenterprisestoaggregate,prioritize,andanalyzerisksfrom

acrosstheenterpriseinacommonriskregisterformat.RiskappetiteexpressedbytheERMprogramhelpsinformriskidentification.

InformationandCommunicationsTechnology(ICT)RiskManagement

ERM

Theinformationandcommunicationstechnology(ICT)onwhichanenterprisereliesismanagedthroughabroadsetofriskdisciplinesthatincludeprivacy,supplychain,andcybersecurity.ICTextendsbeyondtraditionalinformationtechnology(IT)considerations.Manyentities

ICTRM

relyonoperationaltechnology(OT)andInternetofThings(IoT)devices’sensorsoractuatorsforbridgingphysicalanddigitalenvironments.Increasingly,artificialintelligence(AI)factorsintoenterpriserisk.NISTSPs800-221and800-221Aprovidemoreinformation.

CSRM

CybersecurityRiskManagement(CSRM)

Cybersecurityrisksareafundamentaltypeofriskforallorganizationstomanage.Potentialnegativeimpactstoorganizationsfrom

cybersecurityrisksincludehighercosts,lowerrevenue,reputationaldamage,andtheimpairmentofinnovation.Cybersecurityrisks

alsothreatenindividuals’privacyandaccesstoessentialservicesandcanresultinlife-or-deathconsequences.Riskappetiteexpressed

atotherlevelsofriskmanagementgetstranslatedintomorespecificCSRMrisktolerance,suchthatcyberriskscanbemoreeasilyidentified.

CSF2.0providesguidanceforreducingcybersecurityrisksbyhelpingorganizationsdiscuss,organize,andaddressgapsintheircybersecurityprograminastandardway.ThecybersecurityoutcomesdescribedinCSFaffectcybersecurity,ICT,andenterpriserisks.UnderstandingthesedependenciesisanessentialactivityinCSRM,ICTRM,andERM.TheCybersecurityRisk

Register(CSRR)describedintheNISTIR8286seriesofpublicationsenablesorganizationstoidentify,manage,andmonitortherelationshipsbetweendiscreterisksandaspectsofaCSF-

basedcybersecurityprogramthataddressthoserisks.TheCSRRallowsorganizationstoidentify,organize,analyze,andreportoncybersecurityrisksatthesystemlevel.CSFOrganizationalProfilesareanaturalbyproductofacomprehensiveCSRR,becausetherelativepriorityofCSFoutcomesbecomesapparentbasedonhowsignificanttheimpactsofidentifiedcybersecurityrisksmightbetotheorganization’spriorities,suchasitsstrategicobjectives,productsandservices,orcustomers.

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

CSF2.0SupportsSixActivityPointsForInforming,

Implementing,andMonitoringERM

CSF2.0isavaluableguideforhelpingtoreviewandimprovesecurityandprivacyconsiderationsaspartofaholisticenterpriseriskapproach.CSFismosthelpfulwhenitispairedwithotherERM

elements.Forexample,asagencyofficialsandcorporateboardsprovideoversightofallrelevant

risks,theCSFprocesshelpsensurethatcybersecuritystrategyiswell-executed.Managersplanandimplementrisktreatmentbasedonthatstrategy,recordandreportprogress,andprovideagency/businessleaderswithinformationneededforeffectiveoperationsandmissionsuccess.

TheActivityPoints,whicharefurtherdescribedinsubsequentpages,include:

?1–Leadersdefineandrecordenterprisemission,priorities,andriskappetite.Accountabilityisassignedformanagingbothpositiveandnegativetypesofrisk.(GV.OC,GV.RM,GV.SC)

?2–Organization-levelmanagersinterpretriskappetiteintospecificguidanceregardingsecurityandprivacyrequirements,andassociatedrisktolerance.(GV.RR,GV.PO,ID.RA)

?3–Riskstrategyandrequirementsaidimplementationofsharedsecuritysolutionsandsystem-levelcontrolstoachieveanacceptablelevelofrisk.(PROTECT,DETECT,RESPOND,andRECOVER)

Illustrationofenterpriseriskmanagementintegrationandcoordinationfrom

NISTSP800-221

?4–Riskresponseoutcomesarereflectedasresidualriskinsystem-levelriskregistersaspartofongoingassessmentandcontinuousmonitoringactivities.(ID.RA,ID.IM,GV.OV)

?5–Riskregistersarenormalizedandaggregatedattheorganizationalunitlevel,supportingreporting,analysis,andorganization-leveladjustment.(ID.IM,GV.OV)

CSF2.0,aspartofaholisticERMapproach,

helpsensurethatleaderscontinuallyhavethe

informationtheyneedformakinginformed

business/agencydecisions.

?6–Combinedriskresultsfromtheenterpriseareusedtomaintainanenterprise-levelrisk

registerandriskprofile,supportingenterprisebusinessdecisionsandanyadjustmentsneededfortheriskstrategy.(GV.PO,GV.OV)

SupportingResources:

SP800-221

,EnterpriseImpactofInformationandCommunicationsTechnologyRisk:GoverningandManagingICTRiskProgramsWithinanEnterpriseRiskPortfolio

?SP800-221A

,InformationandCommunicationsTechnology(ICT)RiskOutcomes:IntegratingICTRiskManagementProgramswiththeEnterpriseRiskPortfolio

?

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

Basedoninternalandexternalorganizationalcontext,leadersusegovernancesystemstosetriskpriorities,riskappetite,

andriskstrategy.Thisunderstandingsetsthetoneforhowthe

enterpriseconducts,measures,andreportsriskmanagementactivitiesand

performance.Actionsincludeprocessesforaligningprioritiesandriskdirectionfor

businesspartnersandothermembersoftheorganization’scybersecuritysupplychain.

Understandingofobjectivesandriskappetiteenablesmanagerstointerprethowtoapplythosefortheirorganizationalunits(OUs).Managerscreaterisktolerance

statementsandmetrics,defininga“targetstate”thatwillachievestakeholder

objectivessuchasthroughsecuresharedinfrastructure(e.g.,organizationally-tailoredcontrolbaselines,commoncontrols,andmonitoringstrategy).

ThedirectionfromleadershipandOUmanagementisappliedinanoperational

context,supportingsystem-levelriskassessment,requirementsdefinition,and

allocation.Theseenableeffectivecategorization,controlselection/implementation,andongoingsystem-levelauthorization/monitoring.

QuestionstoConsider

ActivityPoint1:Wheredoyoudrawthemissionandstrategicprioritiesoftheorganizationfrom?Doyouhaveaprocessfordefiningandexpressingriskappetite?

ActivityPoint2:Howisriskappetitetranslatedintorisktolerance?

Arecybersecurityriskmanagementstrategyoutcomesreviewedtoinformandadjuststrategyanddirection?

ActivityPoint3:Howareorganizationalpriorities,definitionofacceptablerisk,andperformancerequirementsembeddedinyoursystem-levelriskactivities?

Arethesetranslatedintocontrolselection,systemconstraints,reportingrequirements,andanomalydetection?

RelatedResources

?NISTRiskManagementFramework(RMF)forInformationSystemandOrganizations

-acomprehensive,flexible,repeatable,andmeasurableprocesstomanageinformationsecurityandprivacyrisk

?NISTIR8286series

–specifically

NISTIR8286A-IdentifyingandEstimatingCybersecurityRiskforERM

?NISTSP800-30Rev.1

–GuideforConductingRiskAssessments

Aligningenterpriseprioritieswithstrategicactivity

Asseniorleadersandorganizationalmanagersobserveanddiscussriskmanagementstrategy(totakeadvantageof

opportunitiesandtoavoidknownthreats),theydevelopaplanformanagingrisktotheoptimallevel.

TheoutcomesintheCSFGovernFunction(GV)specificallydriveactionableplanningabouthowtobestmanage

variousenterpriseriskstoICT,includingprivacy,supplychain,AI,IoT,andOTonwhichtheentitydepends.

Beginningwithanunderstandingofwhatinformationandtechnologyaremostimportanttotheenterprisemission,leadersdefineacceptablelevelsofriskforthoseassetsanddescribehowpersonnelinvariousworkroleswillbe

accountableforriskmanagementsuccess.(ID.AM,ID.RA)

Thisactionableandproactivestrategizingalsomakescleartocustomersandotherstakeholdersthateffectiverisk

managementisapriority,thatclearandaccountableplansareinplacetoachievethatmanagement,andthat

monitoringprocessesarecontinuallyidentifying

opportunitiesforimprovement.Theseplansspecificallyapplytheoutcomesdescribedinthe

CSFOrganizational

Profile(s)

,inparticularthePROTECT,DETECT,RESPOND,andRECOVERfunctions.

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

RiskAssessment,RiskTreatment,andInformationSharingEnsureValueandRiskOptimization

SelectRiskResponse

Afterselectingandimplementingcontrolsandothermethodsofrisktreatment,system-levelpersonnelassesstheeffectivenessandefficiencyof

thattreatment(e.g.,throughtheAssessstepoftheNISTRiskManagementFramework).Riskmanagersevaluatethreatsandopportunities,inalignmentwithriskstrategyanddirectionfromenterprise-andorganization-levelguidance.Theydeterminethebenefitsofthefollowing

responses:Mitigate,Accept,Avoid,andTransferfornegativerisks;Realize,Share,Enhance,andAcceptforpositiverisks.

AnalyzeandPrioritizeRisks

Therearebenefitstobothqualitativeandquantitativeriskanalysismethodologiesandeventheuseofmultiplemethodologies,basedon

enterprisestrategy,organizationpreference,anddataavailability(ID.RA).Therelativepriorityofvarioustypesofriskmustbedecideduponbythosewithappropriateauthority,usuallythroughguidanceprovidedthroughtheriskmanagementstrategy(GV.RM).

CommunicateRiskFindingsandDecisions

Thecybersecurityriskregister(CSRR)providesalocationtorecordandcommunicatetheknownsystem-levelthreatsandvulnerabilities,theirimpactonbusinessobjectives,andtheresponsestakenorplanned.Riskmanagersshareinformationaboutresidualrisk,includingmetricsthat

supportongoingassessmentandauthorization,andplansofactions&milestonesformaintainingtheappropriatelevelofriskbasedonstakeholders’expectations(asexpressedinthetargetstateoftheOrganizationalProfiles,especiallytheGOVERNandIDENTIFYfunctions).

QuestionstoConsider

HowdoCSFTargetProfileoutcomes(organizationalagreementonhowtobestprotect,detect,respond,andrecover)informsystem-specificriskassessmentandtreatment?

Howcanweestimatelikelihoodandimpactofthoserisksgiventheplannedoutcomesandknowledgefrompreviousresults?

Isourriskresponseproportionatetotheexposure?

RelatedResources

?SP800-221

,EnterpriseImpactofInformationandCommunicationsTechnologyRisk:GoverningandManagingICTRiskProgramsWithinanEnterpriseRiskPortfolio

?NISTIR8286A

,IdentifyingandEstimatingCybersecurityRiskforEnterpriseRiskManagement

?RiskDetailSchema

RiskDetail

CSRRSchema

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

Monitor-Evaluate-AdjustCycle

(fromNISTSP800-221)

Riskregistersareaggregated,normalized,andsharedbasedonenterprise-

definedriskcategoriesandmeasurementcriteria.Risktolerancestatements

arerefined,ifneeded,toensurebalanceamongICTvalue,organizational

resources,andoptimalrisk.

SupportingResources

?NISTIR8286C,

StagingCybersecurityRisksforERMandGovernanceOversight

CSFoutcomes(e.g.,plannedandcurrent)supporta

Monitor-Evaluate-Adjust(MEA)cycleforachievingERMobjectives.

Asriskmanagementisappliedthroughvariouscontrols(asdescribedabove),theresultsarecontinuallyevaluatedforeffectiveness.CSFprovidesexamplesofhowtodothisthroughCSFInformativeReferences,describedatthe

OnlineInformativeReferences(OLIR)website

.

Attheorganizationlevel,theresultsofvarioussystem-levelactivitiesandresults(asreflectedin

CSRRs)areaggregatedandnormalized.Managersmonitorhowwellthecyberriskstrategyisbeingimplemented,evaluateindicatorstoconfirmperformancegoalsandhighlightpotentialchangesintherisklandscape,andthenmakeanyadjustmentsnecessarytoaccentuate

achievementofopportunities(positiverisk)andreduceimpactfulthreatconditionstoanacceptablelevel.

Thiscycleenablescreationandmaintenanceofanorganization-levelCSRR,andupdatestotheOrganizationalProfilestoreflectrefinedcurrentstateandadjustedTargetState.

MONITOR

?Measurewhethercontrolsarestillimplementedandeffective

?Measuretheextenttowhichcontrolsareimplementedwithoutimpairingorganizationaloperationsandefficiency

EVALUATE

?Assessiforganizationalcontrolsareachievingthedesiredriskresults

?Assessifriskmanagementactivitiesarekeepingriskwithintolerance(e.g.,evaluatingkeyrisksandkeyperformanceindicators)

?ComparecurrentoutcomestothetargetstatedescribedinOrganizationalProfiles

ADJUST

?Implementadditionalcontrolsandenhancementasneeded

?Implementalternativecontrolstoenhanceopportunity

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

QuestionstoConsider

Howaretopcybersecurityrisksidentifiedforleadershipandrecordedintheenterpriseriskregister?

Areescalationcriteriadefinedtoensureaccountabilityandinformationsharing?(

NISTIR

8286C

)

Areprocessesinplacetomarrysystem/organization-levelrisktoenterprise-levelconsiderations?

Howareenterprisesecurityandprivacyrisks(includingopportunities)alignedwithotherrisktypes?

FeedbackfromCSFInformativeReferencesandtheMEAcyclehelpmonitorandadjustriskresponse,appetite/tolerance,andpolicy.

Asriskmanagementcontrolsareoperated,performanceisevaluatedandadjustedtoimproveeffectivenessandefficiency.FeedbackfromtheMEAcyclesometimes

?RiskTolerance

?RiskAppetite

?Policy

?Strategy

resultsinmorethanjustadjustmentstocontrolsandotherInformativeReferences.Feedbackmayleadtoadjustmentsin:

?CSFProfile

?RiskDetailRecord

?RiskResponseDescription

?RiskResponse

Thishelpsreportresultsbacktomanagementandenterpriseleadership.Resultsthatparticularlyreflectoperationalachievement(keyperformanceindicators,orKPIs)

confirmconformancewiththestrategy(GV.RM,GV.SC).Thisalsosupportspersonnelperformancemonitoringandreporting(GV.RR,GV.PO).

Managersintegratedatafromnormalizedandharmonizedriskregistersandfrom

organization-levelreports,complianceandauditreports.Theseareconsideredin

lightofnon-technologyriskmanagementactivities(e.g.,creditrisk,marketrisk,laborrisk).Consideringcompositeoutcomesofpositiveandnegativeriskmanagement

enableseffectivebalanceamonginvestmentsinandresultsofriskmanagement

activity.Resultsarereflectedinanenterpriseriskregister(ERR)andanenterpriseriskprofile(ERP)thatprovidesaprioritizedERR.

Inthisway,CSFhelpstoguidetheselection,implementation,andmonitoringof

specificcontrols(suchasthoseintheinformativereferences),andtheresultsensureaneffectiveandongoingholisticERMsolutionforalltypesofrisk.

NISTCybersecurityFramework2.0:EnterpriseRiskManagementQuick-StartGuide

EXPLOREMORECSF

2.0RESOURCES

?CSF2.0website

?CSF2.0Organizational

Profiles

?InformativeReferences

?SP800-53

–securityandprivacycontrols

?SP800-221

–IntegratingICTriskmanagementandERM

?SP800