Cybersecurity Risk Management Framework for Digital Enterprises

The risk environment of digital businesses poses a challenge where traditional, siloed approaches to cybersecurity fail to provide enough protection from agile attackers and growing regulatory requirements. The paper offers a systematic Cybersecurity Risk Management Framework (CSRMF) designed to combine cybersecurity risk strategies at the governance level with threat assessments for digital-native companies. The CSRMF draws on the Govern function of NIST CSF 2.0, principles of ERM alignment provided by NIST IR 8286 and quantitative scenarios based on the stochastic attack graph modeling technique. Three-layer architecture is proposed: Governance and Strategy Layer defining risk appetite; Assessment and Prioritization Layer with modified Dijkstra-based stochastic risk propagation algorithm; and Response and Monitoring Layer providing treatment options and feedback. Pseudocode for the core risk propagation algorithm is provided, along with the comparison of the proposed approach to ISO/IEC 27001:2022 and basic CSF 2.0 implementation. Analysis shows that the proposed framework allows minimizing structural differences between cybersecurity risk registers and enterprise risk portfolios, ensuring consistency in risk treatment prioritization and providing a repeatable way to integrate emerging risks into strategic decision making.