Skip to main content

SP 1302Final2024

NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using the CSF Tiers

At a glanceA three-page guide to the four CSF Tiers, which describe how rigorous an organization's cybersecurity risk practices are, from ad hoc to adaptive. Leaders can use it to talk about how the district manages risk, not just which controls exist.

Reading level
Leader
Length
3 pages · about 8 min for the key parts
Best for
Superintendents and cabinet, Technology directors
CSF 2.0
Govern
Read it on NIST DOI 10.6028/NIST.SP.1302 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

Tiers 1 to 4 (Partial, Risk Informed, Repeatable, Adaptive) characterize both risk governance and risk management practices. The guide explains how to pick a tier overall or per function, and how to use tiers to set goals and track progress.

How it is organized

  • What the Tiers are
  • Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive
  • Governance and management components of each Tier
  • Selecting Tiers and monitoring progress

What a school district should take from it

  • Tiers describe how you manage risk; rubric levels describe how mature each practice is. They complement each other.
  • Moving from Tier 2 to Tier 3 usually means writing practices down and repeating them on a schedule.

How to use it in your district

  1. Ask the cabinet which Tier best describes district risk decisions today, and which is realistic in two years.
  2. Use the Tier language in board reports to explain process maturity alongside rubric scores.
  3. Pair Tier goals with the School-year operations planner so practices become repeatable.

Common misconceptions

Tier 4 is the goal for everyone.
NIST frames Tiers as a choice that fits the organization's risk and resources; higher is not automatically better.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.RMRisk Management Strategy
  • GV.OVOversight

Tools in the program portal

Related publications

Citation and source

SP 1302, NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using the CSF Tiers. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.1302.

Replaces: SP 1302 initial public draft (2024-02-26).

Topics: Frameworks and profiles, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.