SP 1300Final2024

NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide

At a glanceA practical on-ramp to CSF 2.0 for organizations with little formal security planning, and NIST names schools among its intended readers. It lists actions to consider and questions to ask for each function. Small and rural districts can use it as a first plan.

Reading level: Leader
Length: 9 pages · about 15 min for the key parts
Best for: Superintendents and cabinet, Technology directors, Business officials
CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover

Read it on NIST DOI 10.6028/NIST.SP.1300 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

For each of the six functions the guide offers actions to consider, getting-started prompts, questions to discuss and links to related resources. It is written for organizations without dedicated security staff, which describes many school districts.

How it is organized

Purpose and a short explanation of the CSF
Govern
Identify
Protect
Detect
Respond
Recover
For each function: actions to consider, getting started, questions to consider, related resources

What a school district should take from it

A district with one or two technology staff can start with these actions rather than the full framework.
The questions are good prompts for a superintendent and technology director to work through together.

How to use it in your district

Walk through the Govern and Identify pages with your cabinet in one meeting.
Turn the 'actions to consider' into Improvement plan items with owners.
Use the Respond and Recover questions as the agenda for your first tabletop exercise.
Revisit the guide after your first rubric baseline to pick the next actions.

Common misconceptions

A small business guide does not apply to a school district.: NIST's own description says it can help schools, non-profits and government agencies as well as businesses.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.OCOrganizational Context
GV.RMRisk Management Strategy
ID.AMAsset Management
PR.ATAwareness & Training
RS.MAIncident Management
RC.RPIncident Recovery Plan Execution

Tools in the program portal

Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why
Improvement planGive each gap an owner, a date and a first step
Tabletop exercisesRun a scenario and capture after-action improvements
Guide: NIST CSF 2.0 for school districtsPublic guide

Related publications

CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0
IR 7621 Rev. 1Small organization security fundamentals
Small Business Cybersecurity Corner (web)Small Business Cybersecurity Corner

Citation and source

SP 1300, NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.1300.

Topics: Frameworks and profiles, Small teams. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.