SP 800-83 Rev. 1Final2013

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

At a glanceHow to prevent malware on desktops and laptops and how to handle malware incidents, especially outbreaks across many machines. Written in 2013, before modern ransomware and endpoint detection tools, so use it for the handling process rather than tool advice.

Reading level: Technical
Length: 47 pages · about 30 min for the key parts
Best for: IT staff and service partners
CSF 2.0: Protect, Respond

Read it on NIST DOI 10.6028/NIST.SP.800-83r1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide explains malware threats, then covers prevention (policy, awareness, vulnerability and threat mitigation, defensive architecture) and incident response (preparation, detection and analysis, containment, eradication, recovery, lessons learned).

How it is organized

Understanding malware threats
Malware incident prevention
Malware incident response: prepare, detect and analyze, contain, eradicate, recover, learn

What a school district should take from it

Plan how to contain an outbreak across many student or staff devices at once.
Reimaging may be faster and safer than cleaning for managed devices.

How to use it in your district

Write a short containment procedure for infected devices (isolate, preserve evidence if needed, reimage).
Make sure endpoint protection alerts reach someone who acts on them.
Include an outbreak scenario in a tabletop exercise.

Common misconceptions

Antivirus alone handles malware.: Prevention also needs patching, least privilege and awareness, and someone must respond to alerts.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.PSPlatform Security
RS.MAIncident Management
RS.MIIncident Mitigation

Tools in the program portal

Tabletop exercisesRun a scenario and capture after-action improvements
District operations toolkitLocal scripts for inventory and configuration checks

Related publications

SP 800-61 Rev. 3Incident response
SP 1800-26Ransomware: detect and respond

Citation and source

SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops. National Institute of Standards and Technology. 2013. https://doi.org/10.6028/NIST.SP.800-83r1.

Replaces: SP 800-83 (2005).

Topics: Devices and malware, Incident response. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.