SP 800-209Final2020

Security Guidelines for Storage Infrastructure

At a glanceSecurity recommendations for storage systems and backups, from file servers and storage arrays to virtualized and cloud storage. A draft Revision 1 (2026) puts more weight on attacks against backups. Useful for IT staff who run district file servers or backup systems.

Reading level: Technical
Length: 79 pages · about 45 min for the key parts
Best for: IT staff and service partners
CSF 2.0: Protect, Recover

Read it on NIST DOI 10.6028/NIST.SP.800-209 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Revision in progress. SP 800-209 Rev. 1 initial public draft (2026-07-22) refocuses on threats such as attacks on backups and groups controls into seven families; comments closed 2026-09-08.

Key concepts

The guide surveys storage technologies and their attack surfaces and recommends both general measures (physical security, access control, change management, incident response) and storage-specific ones (data protection, isolation, restoration assurance, encryption).

How it is organized

Storage technologies background
Threats, risks and attack surfaces
Security guidelines for storage deployments

What a school district should take from it

Backups must be protected from the same administrator accounts an attacker would steal.
Test restores; a backup that has never been restored is an assumption.

How to use it in your district

Separate backup administration credentials from everyday administrator accounts and protect them with MFA.
Keep at least one backup copy offline or immutable.
Test a restore of a critical system each semester and record it as evidence.

Common misconceptions

Cloud storage does not need backup planning.: Accidental deletion, sync errors and account compromise affect cloud data too.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.DSData Security
PR.IRTechnology Infrastructure Resilience
RC.RPIncident Recovery Plan Execution

Tools in the program portal

Evidence LockerKeep the artifact that shows a practice is in place
Tabletop exercisesRun a scenario and capture after-action improvements
Cyber insurancePolicy conditions, questionnaire and Breach Day card

Related publications

SP 1800-11Ransomware: recover
SP 800-34 Rev. 1Contingency planning

Citation and source

SP 800-209, Security Guidelines for Storage Infrastructure. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.800-209.

Topics: Data protection and backups, Recovery and continuity. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.