Key concepts
The guide is a starting point for designing a security and privacy risk management program around the RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor). It is not a replacement for the full framework.
How it is organized
- Why risk management matters
- The RMF steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor
- Getting started and further resources
What a school district should take from it
- The RMF is most useful for individual high-stakes systems, such as a student information system.
- For district-wide planning, the CSF is usually the simpler starting point.
How to use it in your district
- Apply the RMF steps to one critical system as a pilot.
- Record who formally accepts the remaining risk for that system.
- Use it to translate between CSF-based plans and RMF-based partner requirements.
Common misconceptions
- RMF and CSF compete.
- They complement each other: the CSF frames priorities, the RMF manages risk for specific systems.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.RMRisk Management Strategy
- ID.RARisk Assessment
Tools in the program portal
- Risk registerRecord gaps leadership formally accepts, with controls and review dates
- Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why
Related publications
- SP 800-37 Rev. 2Risk Management Framework (RMF)
- CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0
Citation and source
SP 1314, NIST Risk Management Framework (RMF) Small Enterprise Quick Start Guide. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.1314.
Topics: Governance and risk, Small teams. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.