IR 7621 Rev. 1Final2016

Small Business Information Security: The Fundamentals

At a glanceA plain-language guide to the basics of information security for small organizations, with worksheets for identifying important information and risks. It predates CSF 2.0 (no Govern function), so pair it with SP 1300. Helpful for very small or rural districts starting from scratch.

Reading level: Leader
Length: 54 pages · about 35 min for the key parts
Best for: Superintendents and cabinet, Business officials, Technology directors
CSF 2.0: Identify, Protect, Detect, Respond, Recover

Read it on NIST DOI 10.6028/NIST.IR.7621r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide explains why small organizations are targets, how to understand and manage risk, and practical safeguards organized under Identify, Protect, Detect, Respond and Recover, plus advice on working with outside help.

How it is organized

Why small organizations are targets
Understanding and managing your risks
Safeguards by function: Identify, Protect, Detect, Respond, Recover
Working with third parties and when to get help
Appendices: worksheets and resources

What a school district should take from it

The worksheets are a quick way to list the district's most important information and who handles it.

How to use it in your district

Use the worksheets in a first planning meeting with the cabinet.
Follow up with SP 1300 to add the Govern function.
Turn the safeguard lists into a starter Improvement plan.

Common misconceptions

Its revision 2 is the current version.: Revision 2 never became final; NIST converted it into a different draft (CSWP 50) aimed at owner-only businesses.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

ID.AMAsset Management
ID.RARisk Assessment
PR.ATAwareness & Training
RS.MAIncident Management
RC.RPIncident Recovery Plan Execution

Tools in the program portal

Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why
Improvement planGive each gap an owner, a date and a first step

Related publications

SP 1300CSF 2.0 small business quick-start guide
Small Business Cybersecurity Corner (web)Small Business Cybersecurity Corner

Citation and source

IR 7621 Rev. 1, Small Business Information Security: The Fundamentals. National Institute of Standards and Technology. 2016. https://doi.org/10.6028/NIST.IR.7621r1.

Replaces: IR 7621 (2009).

Topics: Small teams, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.