SP 800-100r1 draft October 21, 2026, comments due December 4, 2026; SP 800-221r1 draft October 22, 2026, comments due December 7, 2026
Two NIST Drafts Set the December Agenda: An Executive Handbook Rebuilt Around CSF 2.0 and an Enterprise ICT Risk Guide
NIST published two initial public drafts in consecutive days that together describe how executive governance of technology risk should work, and both comment windows close in early December. SP 800-100 Revision 1, the Information Security Handbook for executive leadership, restructures a guide first released in 2006 to align with the organization of the Cybersecurity Framework 2.0, with high-level summaries of governance, risk management, information exchange, security awareness and training, contingency planning, configuration management and incident response, organized under the CSF Identify, Protect and Detect, Respond, Recover functions, plus continuous monitoring strategy and roles. Its comment period runs from October 12 to December 4, 2026. SP 800-221 Revision 1, published October 22, addresses the enterprise impact of information and communications technology risk: it promotes an integrated approach that aggregates and normalizes risk information across cybersecurity, privacy, supply chain, operational technology, Internet of Things and superintelligence, so organizations can express technology risk scenarios in financial, mission and reputational terms comparable to other enterprise risks and allocate resources across competing risk types. NIST ties the draft to the CSF 2.0 Govern function and to the updated enterprise risk management integration in OMB Circular A-123. Its comment period runs through December 7, 2026, at 11:59 p.m. EST. Both are drafts, not final publications, and neither creates a duty on its own; their weight comes from how thoroughly frameworks, contracts and examiners later cite them.
Executives
These two drafts are the closest thing to an official script for the conversation boards keep having: how technology risk is governed, and how it is stated in money and mission terms next to every other enterprise risk. SP 800-221r1 in particular gives leadership a vocabulary for comparing a cyber scenario with a supply or market scenario in one portfolio view. Reading the executive handbook draft now, while comments are open, is cheaper than adopting the final text cold next year.
CIO / CISO
Calendar the two dates separately: SP 800-100r1 comments close December 4 and SP 800-221r1 comments close December 7, each with its own template and submission route. Map your current governance documents against the CSF 2.0 Govern outcomes both drafts assume, and note where your risk register still states technology risk in purely technical terms, because the 221 draft expects financial, mission and reputational expression that an enterprise risk committee can weigh. If your organization comments, the ICT risk aggregation method and the handbook treatment of AI-related risk are the sections with the longest downstream effect.
Engineers
Expect the practical demand to arrive as evidence requests: asset and dependency data that can feed an aggregated risk view, and monitoring outputs that match the continuous monitoring strategy the handbook describes. Keep control evidence mapped to CSF functions now, so a later restructure of governance reporting is a relabeling exercise rather than a rebuild.
Everyone (non-IT)
Nothing in these drafts changes any rule you follow today; they are proposals open for public comment until early December. Their significance is directional: the national standards body is telling organizations to govern technology risk at the top, in the same financial language as every other major risk, and anyone may submit comments through the NIST pages linked in the sources.