Key concepts
The publication explains baseline selection by system impact level, tailoring and building overlays for particular communities or technologies. Release 5.2.0 changed no baselines.
How it is organized
- Fundamentals: baseline selection and tailoring
- Control baselines: low, moderate, high and privacy
- Appendix: overlays
What a school district should take from it
- A baseline is a starting point to tailor, not a final list.
How to use it in your district
- Use it only when an agreement names a federal baseline.
- Otherwise rely on the CSF and rubric targets for district priorities.
- If needed, ask the partner which baseline and overlays apply.
Common misconceptions
- The moderate baseline is a K-12 standard.
- No federal baseline is designated for K-12 districts.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.POPolicy
- PR.PSPlatform Security
Tools in the program portal
- Policy BuilderDraft policy language tied to rubric categories
Related publications
- SP 800-53 Rev. 5Security and privacy control catalog
Citation and source
SP 800-53B, Control Baselines for Information Systems and Organizations. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.800-53B.
Replaces: SP 800-53B original release (2020-10-29).
Topics: Control catalogs and assessment. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.