Key concepts
The guide covers types of threat information (indicators, attacker tactics, defensive actions, incident analysis), setting sharing goals, finding internal and external sources, deciding what can be shared and under what handling rules, joining communities and using what you receive.
How it is organized
- Basics of cyber threat information sharing
- Establishing sharing relationships
- Participating in sharing relationships
- Appendix: information sharing scenarios
What a school district should take from it
- Districts benefit from belonging to at least one K-12 or state sharing community.
- Agree on handling rules so sharing does not expose student or staff data.
How to use it in your district
- Join a K-12 or state threat sharing community and name who reads its alerts.
- Decide in advance what the district will share after an incident, and who approves it.
- Feed relevant alerts into the vulnerability and patch process.
Common misconceptions
- Sharing incident details invites liability.
- Well-scoped sharing of technical indicators, without personal data, helps peers and is common practice.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- ID.RARisk Assessment
- DE.AEAdverse Event Analysis
- RS.COIncident Response Reporting and Communication
Tools in the program portal
- Vulnerability alertsKnown exploited vulnerabilities that match your systems
- Incident DeskDeclare an incident and track reporting clocks
- Two-minute lessonsFree micro-lessons for staff and families
Related publications
- SP 800-61 Rev. 3Incident response
Citation and source
SP 800-150, Guide to Cyber Threat Information Sharing. National Institute of Standards and Technology. 2016. https://doi.org/10.6028/NIST.SP.800-150.
Topics: Logging and detection, Incident response. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.