Skip to main content

CSWP 32 (draft)Draft2024

NIST Cybersecurity Framework 2.0: A Guide to Creating Community Profiles

At a glanceA draft guide to Community Profiles: shared CSF baselines written for a sector, technology or threat that many organizations face. NIST has not published a K-12 Community Profile, so this explains how such a profile would be built. Useful to state associations and consortia.

Reading level
Practitioner
Length
17 pages · about 20 min for the key parts
Best for
Technology directors
CSF 2.0
Govern
Read it on NIST DOI 10.6028/NIST.CSWP.32.ipd ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Draft. NIST may change this document before it is final. Use it to plan, and check CSRC for the final version.

Revision in progress. Still at initial public draft; comments closed 2024-05-03 and no final has been published.

Key concepts

Community Profiles describe the CSF outcomes that matter for a shared situation. The draft covers what a profile should contain, offers a template, and describes a plan, develop, use and maintain lifecycle. Existing NIST community profiles include ransomware and incident response.

How it is organized

  • About Community Profiles
  • What a Community Profile contains (sample template)
  • Lifecycle: plan, develop, use, maintain
  • Resources from NIST's National Cybersecurity Center of Excellence

What a school district should take from it

  • NIST's ransomware profile (IR 8374 Rev. 1) and incident response guidance (SP 800-61 Rev. 3) are written as Community Profiles.
  • A sector-wide K-12 profile would be a community effort; districts can share Target Profiles through their associations meanwhile.

How to use it in your district

  1. Use the existing ransomware and incident response profiles as ready-made targets.
  2. Share anonymized Target Profiles with peer districts through cohort learning to compare priorities.
  3. Watch for a final version before citing this draft in policy.

Common misconceptions

NIST publishes an official K-12 CSF profile.
As of this library's verification, no NIST K-12 or education Community Profile exists.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.OCOrganizational Context
  • GV.RMRisk Management Strategy

Tools in the program portal

Related publications

Citation and source

CSWP 32 (draft), NIST Cybersecurity Framework 2.0: A Guide to Creating Community Profiles. National Institute of Standards and Technology. 2024 (draft). https://doi.org/10.6028/NIST.CSWP.32.ipd.

Topics: Frameworks and profiles. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.