Does your board know what a cyberattack costs the company?

The U.S. standards institute, NIST, has decided to write about cybersecurity for the people who sign the checks, not the people who configure the servers. In October 2026, it opened public comment on two drafts that, together, treat digital risk as business risk and hold leadership accountable for it.

What happened

On October 21, 2026, NIST published the draft revision of its information security handbook. The original version dates from 2006, and the new one is aimed at executive leadership in the public and private sectors. It offers overviews of governance, risk management, awareness and training, contingency planning and incident response, organized around the Cybersecurity Framework 2.0, and leaves technical detail to other documents. The comment period runs through December 4, 2026.

The next day, October 22, came the draft revision of the guide that fits information and communications technology risk into the enterprise risk portfolio. The proposal is to identify, quantify and communicate risk scenarios in financial, mission and reputational terms, so they can be compared with non-technical risks. The text states that security governance should sit at the center of risk management, aligned with strategy and with oversight and resources from senior leadership. It was written for organizations of any size and sector. Comments are due by December 7, 2026.

At the end of the month, NIST also published the final version of a guide for businesses without employees, replacing a 2016 document aimed at small businesses.

Why it matters

At many companies, security is still treated as an IT expense. Someone technical asks for budget, and the board approves or cuts it without really knowing what it is buying. The predictable result is spending too little where the risk is large or too much where it is small.

NIST's move goes straight at that disconnect. When digital risk is expressed in money, in the ability to operate and in reputation, it enters the same conversation as credit risk, supplier risk or the loss of a major customer. It starts competing for budget on the merits, rather than through fear or the insistence of whoever shouts the loudest.

Both documents are voluntary for private companies, in the United States and here. But NIST texts tend to become a reference for auditors, insurers, large customers and regulators. When the market's yardstick changes, companies that supply larger firms may be held to it before any law requires it.

What changes for you

If you are the owner: the useful question now is "how much do we lose if this fails, and who is in charge of it?", in place of "are we protected?" Delegating execution is still right, but delegating accountability is no longer defensible.

If you lead sales: when a corporate customer asks for proof of security before signing a contract, a company that can show governance, a designated owner and a response plan tends to shorten the negotiation, while a company with nothing to show loses time or loses the contract.

If you run operations: the contingency plan comes out of the drawer and onto the meeting agenda. The practical question is how long the company can stay down and what needs to come back first.

What changes in Brazil

Here, the yardstick with the force of law is the LGPD. Under CD/ANPD Resolution No. 15 of April 24, 2024, the controller must notify the ANPD and data subjects, within three business days, of any security incident that may create significant risk or harm, unless specific legislation sets a different deadline. Notification is made by the data protection officer or by a legal representative of the controller. According to the ANPD itself, unjustified delay may lead to the sanctions in Article 52 of the LGPD.

Three business days is little time to find out what happened, decide and communicate. Only companies that have agreed in advance on who decides and who speaks can meet that deadline. This is where NIST's message meets Brazil's legal obligation. Governance, in practice, is what makes it possible to meet a legal deadline on the worst day of the year.

The play

1. Put digital risk on the company's risk register. One line per relevant scenario (operational shutdown, customer data leak, fraud), with an owner, an estimated impact in reais and a priority. A rough estimate beats none.
2. Name an owner in leadership. Someone in a decision-making role who answers for the issue to the board, even if execution stays with an internal team or outside providers.
3. Rehearse the incident before it happens. Define who decides, who notifies the ANPD and customers, and how quickly. A one-hour exercise with the board will already show where the three-business-day deadline would be blown.

The other side

The two main documents are drafts open for public comment and may change. They are voluntary references from a U.S. agency, with no legal effect in Brazil.

Quantifying digital risk in money also has its limits. The numbers rest on fragile assumptions and can create a false sense of precision. A neatly formatted figure in a spreadsheet does not make a scenario any more or less likely. And small companies with lean teams may see more bureaucracy than protection in all this.

The point lies in changing who asks the question, without needing to adopt the entire handbook. As long as digital risk remains an IT-only matter, the company will keep making decisions about it in the dark.