Risk aggregation rolls many discrete risks into a higher level view so leaders can see overall exposure. NIST SP 800-30 notes that the worst case impact of a single risk sets an upper bound for that risk, but the bound can fail when several risks materialize together or the same one repeats.
Why aggregate
A register with 60 entries cannot be read by a board. Leaders want a handful of themes, their combined effect, and the choices on the table. NIST IR 8286 describes the value of rolling up risk measures from system and organization levels to the enterprise level, so cybersecurity risk can be weighed against mission and business objectives. Its IR 8286C part covers how cybersecurity risk register data feeds an enterprise risk register and profile.
What NIST says about the limits
NIST SP 800-30 explains that aggregation assesses the overall risk to operations, assets and individuals given a set of discrete risks. For a single well defined system, the worst case impact normally establishes an upper bound. That logic can break. When multiple risks occur at once, or one risk recurs over time, the total loss can exceed what each assessment assumed, and may go beyond the organization's risk capacity.
In plain terms: you cannot just take the highest item and ignore the rest, and you cannot always add the items together either.
Three practical approaches
- Group by theme. Collect risks that share a cause, such as identity compromise, third party access or data exposure, and describe each theme in one line with the most severe member.
- Look for common causes. If one failing control appears in ten scenarios, it is a concentration risk. Report it once with its reach.
- Test combined scenarios. Ask what happens if two or three related risks occur in the same quarter. Check the answer against your capacity to absorb loss and to respond.
Do not add scores
Adding ratings from a color scale or from a 0 to 100 scale makes no sense, because the numbers are labels, not quantities. If you need totals, use money ranges for the risks in the group and combine them with a method that handles ranges, such as simulation, noting the assumption about whether events are related.
What to report upward
- The top themes, with a plain sentence each.
- Combined worst plausible outcomes, as ranges.
- The decisions needed from leadership, such as funding or acceptance.
- Concentration points and what you are doing about them.
- Changes since the last report.
Keep the detail available
Aggregates must link back to the register entries so anyone can drill down. If a theme cannot be traced to specific scenarios, readers will question it.
Quick check
Is the overall risk the sum of all risk scores?
No. Scores on ordinal scales cannot be added meaningfully. Group by theme, or use money ranges that can be combined.
What is a concentration risk?
A single dependency, such as one identity provider or one shared control, that sits behind many scenarios, so its failure affects many at once.
Sources
Last reviewed: 19 October 2026.
