What happened
On 22 October 2026, NIST released the initial public draft (IPD) of SP 800-221 Rev. 1, 'Governing and Managing ICT Risk Programs Within an Enterprise,' open for public comment through 7 December 2026. The revision expands enterprise information and communications technology risk management (ICTRM) to span and integrate cybersecurity, privacy, supply chain, operational technology, Internet of Things and 'super intelligence.' It updates ERM sections to reflect OMB Circular A-123 (2026), strengthens alignment with NIST IR 8286r1 and the CSF 2.0 Govern function, and adds risk-informed workforce decisions using the risk register per NIST SP 1308.
Why it matters
This is the first NIST publication in the window to formally fold 'super intelligence' into enterprise ICT risk governance, reflecting the 29 September 2026 Executive Order reorientation. It gives organizations a mechanism to normalize and aggregate AI/SI risk in financial, mission and reputational terms alongside conventional enterprise risk — directly usable for executives allocating resources across competing risk types and for aligning to CSF 2.0.
Action needed
CISOs and risk managers should review and submit comments before the 7 December 2026 deadline, and assess how the revised ICTRM approach integrates AI/super-intelligence risk into existing ERM and CSF 2.0 governance.