SP 800-100Final2006

Information Security Handbook: A Guide for Managers

At a glanceA management-level overview of the parts of an information security program, from governance and budgeting to incident response. It is dated (2006, corrected 2007) and NIST has begun a revision, so use it for context rather than current practice.

Reading level: Leader
Length: 178 pages · about 60 min for the key parts
Best for: Technology directors, Superintendents and cabinet
CSF 2.0: Govern

Read it on NIST DOI 10.6028/NIST.SP.800-100 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Revision in progress. NIST issued a pre-draft call for comments on Rev. 1 (January-February 2024); no draft text has been published.

Key concepts

Each chapter explains why a program area matters and how it fits with the others: governance, life cycle, awareness and training, capital planning, interconnections, performance measures, planning, contingency planning, risk management, assessments, acquisition, incident response and configuration management.

How it is organized

Governance
System development life cycle
Awareness and training
Capital planning and investment
Interconnecting systems
Performance measures
Security planning
Contingency planning
Risk management
Assessments
Acquisition
Incident response
Configuration management

What a school district should take from it

The program areas are still the right checklist for a district security program.
Specific methods have moved on: use CSF 2.0 and the newer publications for current practice.

How to use it in your district

Use the chapter list to check that your district program covers each area.
For any area you want to act on, follow the link to the newer NIST publication in this library.
Watch for Rev. 1, which NIST opened for early comment in 2024.

Common misconceptions

A 'handbook' must be the current playbook.: This edition predates the RMF revision and CSF 2.0; treat it as background.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.RRRoles, Responsibilities, and Authorities
GV.POPolicy
GV.OVOversight

Tools in the program portal

Policy BuilderDraft policy language tied to rubric categories
Cybersecurity Rubric 2.0 assessmentRate the 22 categories and record why

Related publications

SP 800-12 Rev. 1Introduction to information security
CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0

Citation and source

SP 800-100, Information Security Handbook: A Guide for Managers. National Institute of Standards and Technology. 2006. https://doi.org/10.6028/NIST.SP.800-100.

Topics: Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.