What is the Cybersecurity Rubric 2.0?

What the Cybersecurity Rubric 2.0 is

The Cybersecurity Rubric 2.0 (CR 2.0) is a free self-assessment that helps a school system rate how mature its cybersecurity practices are. It follows the NIST Cybersecurity Framework 2.0: six functions, 22 categories, and five maturity levels from Initial to Optimized. CoSN, the Consortium for School Networking, now leads it. [1] [4]

The rubric was originally developed by ClassLink and a coalition of education organizations working through the Cybersecurity Coalition for Education (CC4E). On 16 June 2026, CoSN announced it would take over leadership of the rubric and its evaluator credential program, and said it would keep continuity for educators and evaluators already using it. [2] The old address, cybersecurityrubric.org, now forwards to CoSN's rubric page. [1]

CoSN offers the rubric as an interactive tool (the CR Sidekick), a Google Sheets copy, an Excel workbook and a PDF. The Excel edition is dated April 2024 and the PDF edition is dated December 2025. [3] [4] The rubric itself asks users to download a new copy each time they run a system-wide evaluation, because it is reviewed and updated over time. [4]

This week: download a fresh copy from CoSN's download page and save it where your assessment team can work on it together.

How the rubric is structured

CR 2.0 uses the same six functions and 22 categories as NIST CSF 2.0, so every rating you record lines up with a NIST category code. [4] [5] For each category, the rubric describes what practice looks like at each of five levels in school-system terms. You choose the level that best matches your district today.

The five maturity levels are Level 1 Initial, Level 2 Repeatable, Level 3 Defined, Level 4 Managed and Level 5 Optimized. The levels are cumulative: from Level 3 upward, each description starts by requiring everything at the level below. [4] Once every category is rated, the workbook's Results tab calculates function-level results and an overall maturity level; it asks you to rate all categories so the overall result is accurate. [4]

This week: share the table above with your cabinet so everyone knows the 22 areas the baseline will cover.

Who publishes it and the terms of use

CoSN states that the rubric is free for basic internal use, and that its training content, exam components and rubric resources are proprietary assets licensed exclusively to CoSN. [1] In practice, a district can use the rubric to assess itself, but should link to CoSN rather than copying the level descriptions into public documents or vendor materials.

CoSN offers a free course of about 2.5 hours on how to use the rubric, and a deeper CCRE program for individuals who want to master it. CoSN is explicit that the CCRE designation is earned by individuals and that it does not issue district-level recognitions for using the rubric. [1] [2]

This week: ask the person who will lead your assessment to complete the free CoSN course before rating anything.

How it relates to NIST CSF 2.0, CIS Controls and K12 SIX

These resources answer different questions, so districts often use more than one. NIST CSF 2.0 describes outcomes and deliberately does not prescribe how to achieve them. [5] The rubric turns those outcomes into education-specific maturity descriptions. The CIS Critical Security Controls give specific safeguards: version 8.1, released in June 2024, added a Govern security function to match NIST CSF 2.0, and its Implementation Group 1 is a foundational set of 56 safeguards aimed at organizations with limited IT staff. [6] [7] The K12 SIX Essentials Series offers a short list of protections it says every district should prioritize, with implementation rubrics and a district self-assessment in its 2026 edition. [8]

CISA's K-12 guidance follows a similar path: start with a few high-impact measures such as multi-factor authentication, patching known exploited vulnerabilities, tested backups, incident response exercises and training, then build toward an enterprise plan that uses the NIST framework. [9] In the K12 Cyber Forward portal, each rubric category carries guidance and crosswalks to NIST CSF 2.0 and CIS Controls v8.1, so a low rating points to concrete next safeguards.

This week: pick one framework as your "how" list (CIS IG1 or K12 SIX) and keep the rubric as your "how mature" measure. Read more in NIST CSF 2.0 for school districts in plain language.

How a district uses it to set a baseline

A baseline is only useful if the next one can be compared with it. These steps keep the first assessment honest and repeatable.

1. Name an owner and a small team. Pair the technology director with the business official and at least one principal, so Govern and Recover are not rated by IT alone.
2. Use a fresh copy. Download the current edition from CoSN and record which edition you used.
3. Rate what is true today. Score current practice, not plans or purchases in progress. When torn between two levels, choose the lower one and note why.
4. Record evidence. For each rating, note the document, screenshot or report that supports it, and who checked it.
5. Rate all 22 categories. The results calculation depends on every category being rated. [4]
6. Choose three priorities. Turn the lowest-rated categories that matter most to instruction into an improvement plan with owners and dates.
7. Repeat on a schedule. Reassess at least annually, at the same time of year, with a new copy of the rubric.

K12 Cyber Forward supports three review pathways for a baseline: self-assessed, guided, or independently reviewed. Whichever you choose, the evidence notes are what make next year's comparison meaningful. See how it works, or test your Respond and Recover ratings with the ransomware tabletop checklist for a school day.

This week: schedule a two-hour working session to rate the six Govern categories together, then book the remaining functions over the following month.