Skip to main content

SP 1301Final2024

NIST Cybersecurity Framework 2.0: Quick-Start Guide for Creating and Using Organizational Profiles

At a glanceExplains how to describe where you are (Current Profile) and where you want to be (Target Profile) using CSF outcomes, then close the gap. It is the method behind turning an assessment into a plan. Read it before setting rubric targets.

Reading level
Practitioner
Length
10 pages · about 20 min for the key parts
Best for
Technology directors, Superintendents and cabinet
CSF 2.0
Govern, Identify
Read it on NIST DOI 10.6028/NIST.SP.1301 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

The guide walks through a five-step cycle: scope the profile, gather information, create Current and Target Profiles, analyze gaps and build an action plan, then implement and update. NIST provides a spreadsheet template for the profile.

How it is organized

  • Current versus Target Profiles
  • Step 1: scope the profile
  • Step 2: gather information
  • Step 3: create the profile
  • Step 4: analyze gaps and create an action plan
  • Step 5: implement the plan and update the profile

What a school district should take from it

  • A rubric baseline is a Current Profile; target levels are a Target Profile.
  • Scope matters: decide whether a profile covers the whole district or one system, such as the student information system.

How to use it in your district

  1. Treat each rubric assessment as a Current Profile and record your scope on the assessment.
  2. Set target levels per category with leadership, and document why.
  3. Turn the gap list into Improvement plan items, ranked by risk and cost.
  4. Repeat the cycle each year and compare profiles in the progress view.

Common misconceptions

Every category needs the same target level.
Targets should reflect the district's risks and resources. Some categories can reasonably target a lower level than others.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.OCOrganizational Context
  • GV.RMRisk Management Strategy
  • ID.IMImprovement

Tools in the program portal

Related publications

Citation and source

SP 1301, NIST Cybersecurity Framework 2.0: Quick-Start Guide for Creating and Using Organizational Profiles. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.1301.

Topics: Frameworks and profiles, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.