Resources · NIST reference library
Each entry explains what the publication is, who should read it and how a district can use it, then links to the official text on NIST's Computer Security Resource Center.
Start here
Start with a handful of documents, not the whole library. Each path begins with the most useful read for that job.
Superintendents and cabinet
Short reads that help a cabinet set direction, ask good questions and decide which risks to accept.
Technology directors
The core references for running a district cybersecurity program and its plans.
Business officials
Where cybersecurity meets contracts, insurance, procurement and keeping operations running.
IT staff and service partners
Configuration-level guidance for the people who run, monitor and restore district systems.
Library
38 of 70 publications match.
No publications match these filters. Try a broader topic or clear the search.
CSF 2.0 and the quick-start guides that make it usable.
CSF 2.0 (CSWP 29)Final2024
The NIST Cybersecurity Framework (CSF) 2.0
The common language most cybersecurity guidance now uses: six functions (Govern, Identify, Protect, Detect, Respond, Recover) broken into outcomes any organization can work toward. Every district leader should know its shape, because the Cybersecurity Rubric 2.0 is organized the same way. Read it when you set priorities or explain your program to a board.
GovernIdentifyProtectDetectRespondRecover
SP 1299Final2024
NIST Cybersecurity Framework 2.0: Resource and Overview Guide
An eight-page tour of CSF 2.0 with one page per function and a map of NIST's companion resources. It is the fastest way for a cabinet member or new technology hire to get oriented. Read it before the full framework.
GovernIdentifyProtectDetectRespondRecover
SP 1300Final2024
NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
A practical on-ramp to CSF 2.0 for organizations with little formal security planning, and NIST names schools among its intended readers. It lists actions to consider and questions to ask for each function. Small and rural districts can use it as a first plan.
GovernIdentifyProtectDetectRespondRecover
SP 1301Final2024
NIST Cybersecurity Framework 2.0: Quick-Start Guide for Creating and Using Organizational Profiles
Explains how to describe where you are (Current Profile) and where you want to be (Target Profile) using CSF outcomes, then close the gap. It is the method behind turning an assessment into a plan. Read it before setting rubric targets.
GovernIdentify
SP 1302Final2024
NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using the CSF Tiers
A three-page guide to the four CSF Tiers, which describe how rigorous an organization's cybersecurity risk practices are, from ad hoc to adaptive. Leaders can use it to talk about how the district manages risk, not just which controls exist.
Govern
CSF 2.0 online resourcesWeb resource
CSF 2.0 Resource Center, Reference Tool, Informative References and Implementation Examples
NIST's online home for CSF 2.0: the framework, quick-start guides, profile templates, a searchable reference tool and implementation examples for every outcome. The implementation examples are the most practical piece for districts. Bookmark it rather than saving copies.
GovernIdentifyProtectDetectRespondRecover
SP 1347Final2026
NIST Cybersecurity Framework 2.0: Informative References Quick-Start Guide
Explains informative references: crosswalks that connect each CSF outcome to sections of other standards, such as SP 800-53 or other control sets. Useful when you need to show how district practices line up with a specific standard.
GovernIdentify
CSWP 32 (draft)Draft2024
NIST Cybersecurity Framework 2.0: A Guide to Creating Community Profiles
A draft guide to Community Profiles: shared CSF baselines written for a sector, technology or threat that many organizations face. NIST has not published a K-12 Community Profile, so this explains how such a profile would be built. Useful to state associations and consortia.
Govern
IR 7621 Rev. 1Final2016
Small Business Information Security: The Fundamentals
A plain-language guide to the basics of information security for small organizations, with worksheets for identifying important information and risks. It predates CSF 2.0 (no Govern function), so pair it with SP 1300. Helpful for very small or rural districts starting from scratch.
IdentifyProtectDetectRespondRecover
Small Business Cybersecurity Corner (web)Web resource
Small Business Cybersecurity Corner
NIST's hub of free, plain-language resources for small organizations, organized by topic: phishing, ransomware, MFA, cloud, cyber insurance, incident response and more, plus videos and training. A good place for districts with small teams to find short materials for staff.
GovernProtect
Leadership, risk decisions and supplier risk.
SP 1303Final2024
NIST Cybersecurity Framework 2.0: Enterprise Risk Management Quick-Start Guide
Shows how cybersecurity risk feeds into the organization-wide risk discussions leaders already have about finance, safety and operations. Useful for superintendents and business officials who manage district risk as a whole.
Govern
SP 800-30 Rev. 1Final2012
Guide for Conducting Risk Assessments
NIST's standard method for assessing information security risk: identify threats and weaknesses, judge likelihood and impact, and report results leaders can act on. Technology directors use it to make risk assessments repeatable. Read chapter 3 and the likelihood and impact tables first.
IdentifyGovern
SP 800-39Final2011
Managing Information Security Risk: Organization, Mission, and Information System View
Describes an organization-wide approach to information security risk: frame it, assess it, respond to it and monitor it, at the leadership, business process and system levels. It is the big-picture companion to SP 800-30. Useful when a district formalizes who decides how much risk is acceptable.
Govern
SP 1314Final2024
NIST Risk Management Framework (RMF) Small Enterprise Quick Start Guide
An introduction to NIST's Risk Management Framework for small, under-resourced organizations. It explains the value of the seven RMF steps and how to start, without the depth of SP 800-37. Useful if a partner, grant or state agency uses RMF language.
GovernIdentify
SP 1305Final2024
NIST Cybersecurity Framework 2.0: Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)
A short guide to managing the cybersecurity risk that comes with vendors and technology products, using the CSF's supply chain category (GV.SC). It is written for organizations as buyers. Districts can use it to shape procurement and vendor reviews.
Govern
IR 8286 Rev. 1Final2025
Integrating Cybersecurity and Enterprise Risk Management (ERM)
Explains how cybersecurity risks should flow into the risk picture leaders already manage, using cybersecurity risk registers that roll up into an enterprise risk register. Revision 1 aligns the series with CSF 2.0. It suits superintendents and business officials who want cyber risk discussed alongside other district risks.
Govern
IR 8286D (Update 1)Final2025
Using Business Impact Analysis to Inform Risk Prioritization and Response
Shows how a business impact analysis, usually done for continuity planning, can also rank which systems and data deserve the most protection and the fastest recovery. A short, practical read for deciding what matters most when the network is down.
GovernIdentifyRecover
SP 800-221Final2023
Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio
Extends the risk register approach from cybersecurity to all technology risk, including privacy, supply chain and AI, so separate programs feed one enterprise view. Its short companion, SP 800-221A, lists the outcomes to aim for. Useful for business officials coordinating several technology-related risk areas.
Govern
SP 800-161 Rev. 1 (Update 1)Final2024
Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
NIST's comprehensive guide to managing cybersecurity risk from suppliers and technology products, with strategy, policy, plans, risk assessments, controls and templates. It is long and written for large organizations; districts should start with SP 1305 and SP 1326 and use this for depth.
GovernIdentify
SP 1326Final2026
NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide
A short guide to researching a supplier or product before buying it or renewing it. It organizes the review around ownership and outside influence, where the product comes from, resilience, basic cyber practices and the vendor's own suppliers. A practical companion to a district vendor review checklist.
Govern
Passwords and MFA, patching, devices, networks, email and data.
SP 800-63B-4Final2025
Digital Identity Guidelines: Authentication and Authenticator Management
NIST's current rules for passwords and multi-factor authentication (MFA). It favors long passwords over complex ones, drops forced periodic changes, requires checking new passwords against breached-password lists, and expects phishing-resistant MFA options. Technology directors should read it before setting district password and MFA policy.
Protect
SP 800-63-4Final2025
Digital Identity Guidelines
The umbrella volume of NIST's digital identity guidance, covering identity proofing, authentication and federation (single sign-on). It explains how to choose assurance levels based on risk. Read it with SP 800-63B when designing staff, student or family sign-in.
ProtectGovern
SP 800-40 Rev. 4Final2022
Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology
Treats patching as routine preventive maintenance, a normal cost of running technology, rather than an optional security task. It recommends grouping systems, planning for routine and emergency patches, and handling systems that cannot be patched. A short, practical read for technology directors and the business officials who fund maintenance.
ProtectIdentify
SP 800-88 Rev. 2Final2025
Guidelines for Media Sanitization
How to make data on laptops, Chromebooks, drives and copiers unrecoverable before reuse, resale or disposal. Revision 2 (2025) replaced Revision 1 and focuses on running a sanitization program with clear roles and verification. Important for districts that refresh 1:1 devices or use e-waste recyclers.
ProtectIdentify
SP 800-177 Rev. 1Final2019
Trustworthy Email
How to stop attackers from spoofing your district's email domain and how to protect mail in transit, using SPF, DKIM, DMARC and TLS. Written for email administrators, and usable by small organizations. Read the domain authentication chapter first.
ProtectDetect
SP 800-46 Rev. 2Final2016
Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security
How to secure remote access to district systems from home or personal devices: VPNs, portals, remote desktop and direct application access. It advises assuming outside networks are hostile. Useful when staff or contractors reach internal systems from off site.
Protect
SP 800-124 Rev. 2Final2023
Guidelines for Managing the Security of Mobile Devices in the Enterprise
How to secure smartphones and tablets that reach district systems, whether district-owned or personal. It catalogs mobile threats and the management tools that address them, such as mobile device management. Useful for districts with staff phones, tablets or student devices under management.
ProtectIdentify
SP 800-207Final2020
Zero Trust Architecture
Defines zero trust: no user or device is trusted just because it is on the district network, and every access request is checked. It describes the components and deployment options. Useful as a direction for long-term network and identity planning rather than a product purchase.
Protect
SP 800-215Final2022
Guide to a Secure Enterprise Network Landscape
Explains how cloud services and remote users have changed enterprise networks and surveys the security tools now used: cloud access brokers, secure web gateways, next-generation firewalls, microsegmentation and secure access service edge. Helpful when planning a network refresh or E-Rate-funded upgrade.
Protect
SP 800-41 Rev. 1Final2009
Guidelines on Firewalls and Firewall Policy
Explains firewall types, what each can and cannot do, and how to write and maintain a firewall policy. It dates from 2009, so product details are old, but the policy principles (deny by default, documented rules, testing) still hold.
Protect
SP 800-209Final2020
Security Guidelines for Storage Infrastructure
Security recommendations for storage systems and backups, from file servers and storage arrays to virtualized and cloud storage. A draft Revision 1 (2026) puts more weight on attacks against backups. Useful for IT staff who run district file servers or backup systems.
ProtectRecover
SP 1800-25Final2020
Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events
A practice guide from NIST's National Cybersecurity Center of Excellence on the 'before' side of ransomware: inventory what you have, find weaknesses, and harden assets with secure backups, integrity checks, logging and vulnerability management. Volume A, the executive summary, is short enough for leaders.
IdentifyProtect
SP 800-213Final2021
IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements
Helps buyers decide, before purchase, what security capabilities a connected device and its maker must provide. Districts can apply it to cameras, door access, HVAC controls, interactive displays and other connected equipment. Pair it with IR 8259A's baseline of device capabilities.
GovernProtect
IR 8259AFinal2020
IoT Device Cybersecurity Capability Core Baseline
A short list of six security capabilities connected devices should generally have: a unique identity, configurable settings, data protection, restricted interface access, secure software updates and awareness of their own security state. A practical checklist for purchasing.
ProtectGovern
SP 800-144Final2011
Guidelines on Security and Privacy in Public Cloud Computing
Lists the security and privacy issues to weigh before moving data or services to a public cloud provider, from governance and compliance to data protection and incident response. Dated (2011), but its outsourcing questions still fit software-as-a-service decisions.
GovernProtect
Logging, monitoring, threat sharing and security testing.
SP 800-92Final2006
Guide to Computer Security Log Management
How to plan and run log management: which logs to collect, how to store and protect them, and how to review them. The final is from 2006; a 2023 draft playbook (Revision 1) gives a shorter, more current planning approach. Useful before buying a log or monitoring service.
DetectProtect
SP 1800-26Final2020
Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events
A practice guide on the 'during' phase of ransomware and other destructive attacks: spotting, containing and limiting damage to databases, files and configurations as an attack happens. Volume A gives leaders the overview; the other volumes are for technical staff.
DetectRespond
SP 800-94Final2007
Guide to Intrusion Detection and Prevention Systems (IDPS)
Explains intrusion detection and prevention technologies (network, wireless, behavior analysis and host-based) and how to choose, deploy and run them. It dates from 2007 and a planned revision was retired, so treat product details as background.
Detect
SP 800-150Final2016
Guide to Cyber Threat Information Sharing
Explains what threat information is worth sharing, why sharing helps both sides, and how to set up and take part in sharing communities safely. Districts can apply it to K-12 and state sharing groups and to peer networks.
IdentifyDetectRespond
SP 800-115Final2008
Technical Guide to Information Security Testing and Assessment
How to plan and run technical security tests (reviews, scanning, penetration testing) and turn results into fixes. Its rules-of-engagement template is especially useful when hiring an outside tester. Tool specifics are dated (2008), but the process is sound.
IdentifyDetect
Incident response, ransomware and getting back to school.
SP 800-61 Rev. 3Final2025
Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile
NIST's current incident response guidance, rewritten in 2025 to fit CSF 2.0. It treats incident response as part of everyday risk management: preparation lives in Govern, Identify and Protect; handling lives in Detect, Respond and Recover. Every district's incident response plan should be built on it.
GovernIdentifyProtectDetectRespondRecover
IR 8374 Rev. 1Final2026
Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile
The CSF 2.0 outcomes that matter most against ransomware, including data-theft extortion, organized under all six functions. Districts can use it as a ready-made target to measure ransomware readiness and build a response playbook. Revision 1 (2026) replaced the 2022 edition.
GovernIdentifyProtectDetectRespondRecover
Ransomware quick start (2022)Final2022
Getting Started with Cybersecurity Risk Management: Ransomware
A four-page introduction for leaders on starting ransomware risk management with NIST's ransomware profile. It was written for the 2022 profile, so pair it with IR 8374 Revision 1 for current outcomes.
GovernRespond
Ransomware protection and response (web)Web resource
Ransomware Protection and Response
NIST's central page for ransomware guidance, linking the ransomware profile, the quick start guide and the three data integrity practice guides. Bookmark it as the starting point for ransomware planning.
ProtectRespondRecover
SP 800-34 Rev. 1Final2010
Contingency Planning Guide for Federal Information Systems
The classic guide to writing and maintaining contingency and disaster recovery plans for information systems, including a business impact analysis to set recovery priorities. The templates in its appendices are a practical starting point for districts. Written for federal systems in 2010, it remains NIST's current contingency planning guide.
RecoverIdentifyProtect
SP 800-184Final2016
Guide for Cybersecurity Event Recovery
Focuses on the Recover side: planning recovery inside risk management, building recovery playbooks, learning from past events and measuring recovery. Two worked scenarios (a data breach and destructive malware) make it concrete. Useful for writing the recovery half of an incident response plan.
RecoverIdentify
SP 1800-11Final2020
Data Integrity: Recovering from Ransomware and Other Destructive Events
A practice guide on restoring data after it has been corrupted or destroyed by ransomware, other malware, an insider or an honest mistake. It shows a tested lab approach to restoring across typical systems with logging to support investigation.
RecoverProtect
SP 800-83 Rev. 1Final2013
Guide to Malware Incident Prevention and Handling for Desktops and Laptops
How to prevent malware on desktops and laptops and how to handle malware incidents, especially outbreaks across many machines. Written in 2013, before modern ransomware and endpoint detection tools, so use it for the handling process rather than tool advice.
ProtectRespond
Awareness programs, phishing, roles and student pathways.
SP 800-50 Rev. 1Final2024
Building a Cybersecurity and Privacy Learning Program
How to plan, build, run and improve a combined cybersecurity and privacy learning program covering awareness, role-based training and education. It focuses on changing behavior and building culture, with metrics to show whether the program works. The core reference for a district staff training program.
ProtectGovern
TN 2276Final2023
NIST Phish Scale User Guide
A method for rating how hard a phishing email is to recognize, so click and report rates from phishing exercises can be read in context. It explains why a rising click rate may reflect a harder email, not worse staff. Check NIST's license terms before using it in a program.
Protect
SP 800-181 Rev. 1Final2020
Workforce Framework for Cybersecurity (NICE Framework)
A shared vocabulary for describing cybersecurity work: tasks, knowledge and skills, grouped into work roles and competency areas. Districts can use it to write job descriptions, plan staff development and talk with partners about coverage. The detailed lists are published separately as NICE Framework Components.
Govern
SP 1308Final2026
NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide
Connects cybersecurity risk, enterprise risk and staffing decisions, pairing CSF 2.0 with the NICE Workforce Framework. Superintendents and business officials can use it to justify roles, contracts or training based on actual risk.
Govern
SP 800-12 Rev. 1Final2017
An Introduction to Information Security
A plain-language primer on information security for people new to the field: principles, roles, threats, policy, risk management and the families of security controls. A good first read for a new technology hire or a cabinet member who wants the basics.
GovernProtect
NICE K12 resources (web)Web resource
NICE K12 Cybersecurity Education: Community of Interest, conference and resources
NIST's NICE program supports K-12 cybersecurity education and careers: an open community of educators that meets monthly, a national K-12 cybersecurity education conference, and resources for counselors and teachers. This is about teaching students, not securing the district, but many districts connect the two.
Govern
SP 800-114 Rev. 1Final2016
User's Guide to Telework and Bring Your Own Device (BYOD) Security
A guide for individual staff rather than IT teams: how to protect personal computers, phones and home networks used for work. Technology directors can borrow from it for staff guidance on working from home or using personal devices.
Protect
Youth security and privacy research (web)Web resource
Human-Centered Cybersecurity: Youth Security and Privacy
NIST research on how children and teens understand online privacy and security, studied with students, parents and teachers. It includes findings on children's password habits and short videos and posts for parents. Useful background for student digital citizenship and family outreach.
Protect
Student data privacy and AI risk.
Privacy Framework 1.0 (CSWP 10)Final2020
NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0
A voluntary framework for managing privacy risk, built to sit alongside the Cybersecurity Framework. It helps districts think about how student and staff data is collected, used and shared, not only how it is secured. Version 1.1 is in draft and aligns with CSF 2.0.
GovernIdentifyProtect
AI RMF 1.0 (NIST AI 100-1)Final2023
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
A voluntary framework for managing the risks of designing, buying or using AI systems, organized as Govern, Map, Measure and Manage. It describes what makes AI trustworthy, such as being valid, safe, secure, fair, transparent and privacy-enhanced. Useful for districts writing AI guidance or evaluating AI tools.
GovernIdentify
NIST AI 600-1Final2024
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
Applies the AI Risk Management Framework to generative AI such as chatbots and image generators. It names risks that generative AI creates or makes worse, from confabulated answers to data privacy and information security, and lists suggested actions. A practical companion for district generative AI guidance.
GovernIdentifyProtect
IR 8596 (preliminary draft)Draft2025
Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile): NIST Community Profile
An early draft CSF 2.0 Community Profile about two things: securing AI systems and using AI to strengthen cyber defense. It is a preliminary draft released for feedback, so read it for direction, not as settled guidance.
GovernProtectDetect
Detailed or older publications to consult for specific questions.
SP 800-53 Rev. 5Final2020
Security and Privacy Controls for Information Systems and Organizations
NIST's comprehensive catalog of security and privacy controls, organized into 20 families from Access Control to Supply Chain Risk Management. Districts rarely implement it directly, but it is the detailed reference behind many frameworks, questionnaires and crosswalks. Look up specific controls rather than reading it cover to cover.
GovernIdentifyProtectDetectRespondRecover
SP 800-53A Rev. 5Final2022
Assessing Security and Privacy Controls in Information Systems and Organizations
Assessment procedures for every SP 800-53 control, with three methods: examine documents, interview people and test mechanisms. Useful for anyone reviewing evidence, including district teams preparing for an independent review. Read chapter 3 and the method descriptions, not the whole catalog.
IdentifyGovern
SP 800-53BFinal2020
Control Baselines for Information Systems and Organizations
Ready-made starting sets of SP 800-53 controls for federal systems: low, moderate and high security baselines and a privacy baseline. Districts seldom need it unless a contract specifies a federal baseline.
GovernProtect
SP 800-37 Rev. 2Final2018
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
The seven-step Risk Management Framework that federal agencies use to secure and authorize systems: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Most districts will not run the full RMF, but its steps are a sound model for launching a major new system. Use SP 1314 for a short introduction.
GovernIdentify
SP 800-218 (SSDF 1.1)Final2022
Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities
A set of secure software development practices for software producers. Districts are buyers, not developers, so its main use is a shared vocabulary for asking edtech and software vendors how they build and patch their products.
Govern
SP 800-100Final2006
Information Security Handbook: A Guide for Managers
A management-level overview of the parts of an information security program, from governance and budgeting to incident response. It is dated (2006, corrected 2007) and NIST has begun a revision, so use it for context rather than current practice.
Govern
SP 800-171 Rev. 3Final2024
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
Security requirements that federal agencies place, through contracts or agreements, on organizations that handle Controlled Unclassified Information (CUI). Most districts are not covered, but a federal grant, research partnership or contract could bring it in. Check your agreements before assuming either way.
ProtectGovern
SP 800-86Final2006
Guide to Integrating Forensic Techniques into Incident Response
Practical guidance for IT staff (not law enforcement) on collecting, examining and analyzing data during incident investigations. Tool details are dated (2006), but the core lesson still matters: preserve evidence before wiping systems, and know when to call specialists.
Respond
SP 800-45 Version 2Final2007
Guidelines on Electronic Mail Security
A 2007 guide to securing self-hosted mail servers and clients. It is still listed as final but predates DMARC and cloud email. Districts on hosted email should use the newer Trustworthy Email guide (SP 800-177) instead.
Protect
SP 800-210Final2020
General Access Control Guidance for Cloud Systems
Technical guidance on access control for each cloud service model: infrastructure, platform and software as a service. Most useful to IT staff who administer cloud tenants and their permissions.
Protect
Summaries are written in plain language by the K12 Cyber Forward program team for school district leaders and IT staff. Each entry was checked against its official NIST page for the current revision and status, and links go to the official NIST page and DOI.
Works written by NIST employees are not subject to copyright in the United States. NIST reserves rights abroad and allows reuse with a citation and the line 'Republished courtesy of the National Institute of Standards and Technology.' Some NIST publications include third-party material that may be under copyright. These summaries are our own words and cite each publication. NIST copyright and usage statement ↗
The official text on csrc.nist.gov always controls. Summaries are general information, not legal or compliance advice.
Turn reading into progress
K12 Cyber Forward connects these publications to your Cybersecurity Rubric 2.0 baseline, so each read leads to an owned next step.