NIST IR 8286D
NIST Interagency Report 8286D, "Using Business Impact Analysis to Inform Risk Prioritization and Response", is the fifth document in the NIST IR 8286 series on integrating cybersecurity risk management with enterprise risk management.
Published in November 2022 and updated in 2025 (NIST IR 8286D-upd1), it takes the business impact analysis that continuity planners already run for availability and widens it to confidentiality and integrity, so that the impact of a compromised asset can be expressed in terms the enterprise risk register understands.
The report is guidance, not a requirement; no assessor exists for it. Organizations that use it produce an asset inventory tied to business processes, impact criteria and ratings for each asset across the three security objectives, and a prioritization that feeds the cybersecurity risk register and response decisions described in the rest of the 8286 series.
help
Who has to comply
Voluntary guidance aimed at US federal agencies integrating cybersecurity into enterprise risk management, and usable by any organization. No mandate attaches to it directly.
What the assessor asks to see
Asset and business process inventory; impact criteria for confidentiality, integrity, and availability; BIA records with impact ratings per asset; linkage to the cybersecurity risk register; risk response decisions traceable to the BIA.
Who helps with NIST IR 8286D
Risk management and continuity consultancies incorporate it into BIA and risk register work. Engagements are usually part of a broader ERM or continuity program rather than standalone.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first NIST IR 8286D consultant listed here
The people reading this are working out who can help them get there.
Who assesses NIST IR 8286D
None.
Assessors
Be the first NIST IR 8286D assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for NIST IR 8286D
Tools that name this framework in their own material.
Tools
Be the first tool listed for NIST IR 8286D
Buyers comparing software for this standard land here first.
Need a hand implementing it?
Find a Consultant for NIST IR 8286D
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with NIST IR 8286D
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.