A good answer should explain the meaning and limitations of aggregation before discussing dashboards. Ask the expert to demonstrate how a reported exposure connects to a business objective and a decision.
Why it matters to buyers. NIST IR 8286C Revision 1, published in December 2025, addresses integrating cybersecurity risk-register information into an enterprise risk portfolio and profile. Its focus is the connection between risk information and enterprise objectives—not simply collecting registers in one place. (csrc.nist.gov)
Put it to: Norman Marks and Michael Rasmussen, with the buyer’s risk methodology owner.
A strong answer should cover: - Common definitions for impact, likelihood, time horizon, appetite and tolerance. - How local scales are translated—and where translation would be inappropriate. - Treatment of common causes, dependencies, overlapping scenarios and potential double counting. - The distinction between exposure, control assessment, assessment confidence and data freshness. - Who may challenge a score, approve an override and see the original assessment.
Ask for proof: take two business units with different scales and a shared supplier dependency. Require the expert to explain the resulting enterprise view, including what cannot defensibly be reduced to one number.
Follow-up: “What information would the board lose if we replaced this explanation with a single red, amber or green indicator?”
Expert quote — pending interview: [Insert approved quotation and attribution.]
Sources cited on this page
- csrc.nist.gov ↗csrc.nist.gov