Key concepts
The guide frames ransomware defense as risk-based action and as a way to communicate with leadership, partners and suppliers, and points to related NIST resources. Spanish and Portuguese translations are available.
How it is organized
- What the ransomware profile is
- How to get started
- Related NIST resources
What a school district should take from it
- A short read that helps a cabinet agree ransomware is a business risk, not just a technology one.
How to use it in your district
- Share it with the cabinet before a ransomware tabletop.
- Use its questions to open the conversation, then work from IR 8374 Revision 1 for specifics.
- Share the Spanish translation with staff who prefer it.
Common misconceptions
- Its references are current.
- It points to the 2022 profile; use IR 8374 Revision 1 for the CSF 2.0 version.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.RMRisk Management Strategy
- RS.MAIncident Management
Tools in the program portal
- Guide: Ransomware tabletop checklist for a school dayPublic guide
- Tabletop exercisesRun a scenario and capture after-action improvements
Related publications
- IR 8374 Rev. 1Ransomware risk management profile
Citation and source
Ransomware quick start (2022), Getting Started with Cybersecurity Risk Management: Ransomware. National Institute of Standards and Technology. 2022. https://csrc.nist.gov/pubs/other/2022/02/24/getting-started-with-cybersecurity-risk-management/final.
Topics: Ransomware, Small teams. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.