IR 8374 Rev. 1Final2026

Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile

At a glanceThe CSF 2.0 outcomes that matter most against ransomware, including data-theft extortion, organized under all six functions. Districts can use it as a ready-made target to measure ransomware readiness and build a response playbook. Revision 1 (2026) replaced the 2022 edition.

Reading level: Practitioner
Length: 23 pages · about 30 min for the key parts
Best for: Superintendents and cabinet, Technology directors, Business officials, IT staff and service partners
CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover

Read it on NIST DOI 10.6028/NIST.IR.8374r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

This Community Profile selects and explains the CSF 2.0 outcomes most useful for governing, preventing, detecting, responding to and recovering from ransomware. It now includes the Govern function and covers both encryption-for-ransom and theft-and-extortion attacks. An appendix lists NIST's other ransomware resources.

How it is organized

Introduction: the ransomware challenge and how to use a Community Profile
The Ransomware Community Profile: CSF 2.0 outcomes by function
Appendix: additional NIST ransomware resources

What a school district should take from it

Ransomware readiness is mostly basics done well: MFA, patching, tested offline backups, and a practiced plan.
Decide in advance who would weigh a ransom demand, with counsel and your insurer, and how.
Data-theft extortion means backups alone are not enough; limit and monitor data access too.

How to use it in your district

Compare your rubric ratings for the listed categories with the profile's outcomes to find ransomware gaps.
Make tested, offline or immutable backups of critical systems a top Improvement plan priority.
Run a ransomware tabletop on a school day scenario and update the plan.
Confirm your insurer's or pool's ransomware conditions and notification steps.
Use the profile as the checklist for a ransomware playbook.

Common misconceptions

Good backups make ransomware harmless.: Attackers may also steal data before encrypting it, which the profile now covers, so prevention and access control matter too.
The 2022 ransomware profile is still current.: It was withdrawn in June 2026 and replaced by Revision 1, aligned to CSF 2.0.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.RMRisk Management Strategy
ID.AMAsset Management
PR.AAIdentity Management, Authentication, and Access Control
PR.DSData Security
DE.CMContinuous Monitoring
RS.MAIncident Management
RC.RPIncident Recovery Plan Execution

Tools in the program portal

Guide: Ransomware tabletop checklist for a school dayPublic guide
Tabletop exercisesRun a scenario and capture after-action improvements
Cyber insurancePolicy conditions, questionnaire and Breach Day card
Improvement planGive each gap an owner, a date and a first step
Risk registerRecord gaps leadership formally accepts, with controls and review dates

Related publications

Ransomware quick start (2022)Ransomware quick start
Ransomware protection and response (web)NIST ransomware resource hub
SP 800-61 Rev. 3Incident response
SP 1800-11Ransomware: recover

Citation and source

IR 8374 Rev. 1, Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile. National Institute of Standards and Technology. 2026. https://doi.org/10.6028/NIST.IR.8374r1.

Replaces: IR 8374 (2022, withdrawn 2026-06-11).

Topics: Ransomware, Incident response, Frameworks and profiles. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.