Skip to main content

SP 1303Final2024

NIST Cybersecurity Framework 2.0: Enterprise Risk Management Quick-Start Guide

At a glanceShows how cybersecurity risk feeds into the organization-wide risk discussions leaders already have about finance, safety and operations. Useful for superintendents and business officials who manage district risk as a whole.

Reading level
Leader
Length
8 pages · about 15 min for the key parts
Best for
Superintendents and cabinet, Business officials
CSF 2.0
Govern
Read it on NIST DOI 10.6028/NIST.SP.1303 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

The guide relates enterprise risk management, broader technology risk and cybersecurity risk, and describes points where CSF activities inform and are steered by enterprise decisions. It introduces the cybersecurity risk register approach detailed in the IR 8286 series.

How it is organized

  • How ERM, technology risk and cybersecurity risk relate
  • The cybersecurity risk register (IR 8286 series)
  • Points where CSF activities inform, implement and monitor enterprise risk decisions

What a school district should take from it

  • Cyber risk belongs on the same list as other district risks, with an owner and a stated tolerance.
  • A short risk register is the bridge between the technology team and the cabinet.

How to use it in your district

  1. Add the top three cyber risks to the district's enterprise or cabinet risk list.
  2. Record risks leadership accepts in the Risk register, with a review date.
  3. Ask the business office to include cyber risks in insurance and budget planning.

Common misconceptions

ERM is only for large organizations with a risk office.
The core idea, one shared list of top risks with owners, works for any district cabinet.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.RMRisk Management Strategy
  • GV.OVOversight

Tools in the program portal

  • Risk registerRecord gaps leadership formally accepts, with controls and review dates
  • Cyber insurancePolicy conditions, questionnaire and Breach Day card
  • Board briefA one-page summary for your board

Related publications

Citation and source

SP 1303, NIST Cybersecurity Framework 2.0: Enterprise Risk Management Quick-Start Guide. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.1303.

Replaces: SP 1303 initial public draft (2024-02-26).

Topics: Governance and risk, Frameworks and profiles. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.