Framework Defense, Supply Chain & NIST Catalogue
NIST IR 8286D
NIST Interagency Report 8286D, "Using Business Impact Analysis to Inform Risk Prioritization and Response", is the fifth document in the NIST IR 8286 series on integrating cybersecurity risk management with enterprise risk management.
Published in November 2022 and updated in 2025 (NIST IR 8286D-upd1), it takes the business impact analysis that continuity planners already run for availability and widens it to confidentiality and integrity, so that the impact of a compromised asset can be expressed in terms the enterprise risk register understands.
The report is guidance, not a requirement; no assessor exists for it. Organizations that use it produce an asset inventory tied to business processes, impact criteria and ratings for each asset across the three security objectives, and a prioritization that feeds the cybersecurity risk register and response decisions described in the rest of the 8286 series.
help
Who has to comply
Voluntary guidance aimed at US federal agencies integrating cybersecurity into enterprise risk management, and usable by any organization. No mandate attaches to it directly.
What the assessor asks to see
Asset and business process inventory; impact criteria for confidentiality, integrity, and availability; BIA records with impact ratings per asset; linkage to the cybersecurity risk register; risk response decisions traceable to the BIA.
Assessors
Who assesses NIST IR 8286D
None.
No firm has claimed a NIST IR 8286D assessor listing yet. Claim yours →
Consultants
Who helps with NIST IR 8286D
Risk management and continuity consultancies incorporate it into BIA and risk register work. Engagements are usually part of a broader ERM or continuity program rather than standalone.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a NIST IR 8286D consultant listing yet. Claim yours →
Software
Tools for NIST IR 8286D
Tools that name this framework in their own material.
Need a hand implementing it?
Find a Consultant for NIST IR 8286D
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Get Help with NIST IR 8286D
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.