SP 1800-25Final2020

Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events

At a glanceA practice guide from NIST's National Cybersecurity Center of Excellence on the 'before' side of ransomware: inventory what you have, find weaknesses, and harden assets with secure backups, integrity checks, logging and vulnerability management. Volume A, the executive summary, is short enough for leaders.

Reading level: Technical
Length: about 40 min for the key parts
Best for: IT staff and service partners, Technology directors
CSF 2.0: Identify, Protect

Read it on NIST DOI 10.6028/NIST.SP.1800-25 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide describes an example solution built in a lab with commercial and open-source products. Like other SP 1800 guides it has an executive summary, an approach and architecture volume, and how-to volumes for product configuration.

How it is organized

Volume A: executive summary
Volume B: approach, architecture and security characteristics
Volume C: how-to guides

What a school district should take from it

Inventory and secure backups come before advanced tools.
Use the architecture as a checklist of capabilities, not a shopping list.

How to use it in your district

Read Volume A with the cabinet to frame ransomware readiness.
Compare the capabilities in Volume B with what the district has today.
Turn missing capabilities into Improvement plan items in priority order.

Common misconceptions

You need the products used in the lab.: The lab shows one way to build the capabilities; other products can provide them.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

ID.AMAsset Management
ID.RARisk Assessment
PR.DSData Security
PR.PSPlatform Security

Tools in the program portal

Improvement planGive each gap an owner, a date and a first step
Vulnerability alertsKnown exploited vulnerabilities that match your systems
District operations toolkitLocal scripts for inventory and configuration checks

Related publications

SP 1800-26Ransomware: detect and respond
SP 1800-11Ransomware: recover
IR 8374 Rev. 1Ransomware risk management profile

Citation and source

SP 1800-25, Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.1800-25.

Topics: Ransomware, Data protection and backups, Patching and vulnerabilities. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.