# 3. How should the platform combine risk information without manufacturing a misleading enterprise score?

**A good answer should explain the meaning and limitations of aggregation before discussing dashboards.** Ask the expert to demonstrate how a reported exposure connects to a business objective and a decision.

**Why it matters to buyers.** NIST IR 8286C Revision 1, published in December 2025, addresses integrating cybersecurity risk-register information into an enterprise risk portfolio and profile. Its focus is the connection between risk information and enterprise objectives—not simply collecting registers in one place. ([csrc.nist.gov](https://csrc.nist.gov/pubs/ir/8286/c/r1/final))

**Put it to:** Norman Marks and Michael Rasmussen, with the buyer’s risk methodology owner.

**A strong answer should cover:**
- Common definitions for impact, likelihood, time horizon, appetite and tolerance.
- How local scales are translated—and where translation would be inappropriate.
- Treatment of common causes, dependencies, overlapping scenarios and potential double counting.
- The distinction between exposure, control assessment, assessment confidence and data freshness.
- Who may challenge a score, approve an override and see the original assessment.

**Ask for proof:** take two business units with different scales and a shared supplier dependency. Require the expert to explain the resulting enterprise view, including what cannot defensibly be reduced to one number.

**Follow-up:** “What information would the board lose if we replaced this explanation with a single red, amber or green indicator?”

> **Expert quote — pending interview:** [Insert approved quotation and attribution.]