SP 1800-11Final2020

Data Integrity: Recovering from Ransomware and Other Destructive Events

At a glanceA practice guide on restoring data after it has been corrupted or destroyed by ransomware, other malware, an insider or an honest mistake. It shows a tested lab approach to restoring across typical systems with logging to support investigation.

Reading level: Technical
Length: about 40 min for the key parts
Best for: IT staff and service partners, Technology directors
CSF 2.0: Recover, Protect

Read it on NIST DOI 10.6028/NIST.SP.1800-11 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

NIST's National Cybersecurity Center of Excellence built and tested a reference environment for data restoration. The guide follows the standard three-volume SP 1800 layout.

How it is organized

Volume A: executive summary
Volume B: approach, architecture and security characteristics
Volume C: how-to guides

What a school district should take from it

Restoring from backups at scale takes planning and practice; time it before an incident.
Logs help prove what was affected, which matters for notification decisions.

How to use it in your district

Time a full restore of a critical system and compare it with the agreed maximum downtime.
Confirm backup copies cannot be deleted by a compromised administrator account.
Use Volume A to brief leadership on what recovery requires.

Common misconceptions

Recovery is just pressing restore.: Large restores need tested procedures, clean systems and the right sequence.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

RC.RPIncident Recovery Plan Execution
PR.DSData Security

Tools in the program portal

Tabletop exercisesRun a scenario and capture after-action improvements
Evidence LockerKeep the artifact that shows a practice is in place
Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

SP 1800-25Ransomware: identify and protect
SP 1800-26Ransomware: detect and respond
SP 800-209Storage and backup security

Citation and source

SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive Events. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.1800-11.

Topics: Ransomware, Recovery and continuity, Data protection and backups. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.