NISTIR 8374

Ransomware Risk Management:
A Cybersecurity Framework Profile

William C. Barker
William Fisher
Karen Scarfone
Murugiah Souppaya

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374

NISTIR 8374

Ransomware Risk Management:
A Cybersecurity Framework Profile

William C. Barker
Dakota Consulting
Silver Spring, MD

William Fisher

Applied Cybersecurity Division
Information Technology Laboratory

Karen Scarfone

Scarfone Cybersecurity
Clifton, VA

Murugiah Souppaya

Computer Security Division
Information Technology Laboratory

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374

February 2022

U.S. Department of Commerce

Gina M. Raimondo, Secretary

National Institute of Standards and Technology
James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce
for Standards and Technology & Director, National Institute of Standards and Technology

National Institute of Standards and Technology Interagency or Internal Report 8374
28 pages (February 2022)

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best
available for the purpose.
There may be references in this publication to other publications currently under development by NIST in accordancewith its assigned statutory responsibilities. The information in this publication, including concepts and methodologies,
may be used by federal agencies even before the completion of such companion publications. Thus, until eachpublication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For
planning and transition purposes, federal agencies may wish to closely follow the development of these new
publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to
NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.
Submit comments on this publication to: ransomware@nist.gov
National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA).

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advancethe development and productive use of information technology. ITL’s responsibilities include thedevelopment of management, administrative, technical, and physical standards and guidelines forthe cost-effective security and privacy of other than national security-related information infederal information systems.
This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

Abstract
Ransomware is a type of malicious attack where attackers encrypt an organization’s data anddemand payment to restore access. Attackers may also steal an organization’s information anddemand an additional payment in return for not disclosing the information to authorities,
competitors, or the public. This Ransomware Profile identifies the Cybersecurity Framework
Version 1.1 security objectives that support identifying, protecting against, detecting, responding
to, and recovering from ransomware events. The profile can be used as a guide to managing therisk of ransomware events. That includes helping to gauge an organization’s level of readiness tocounter ransomware threats and to deal with the potential consequences of events.
Keywords
Cybersecurity Framework; detect; identify; protect; ransomware; recover; respond; risk; security.
Acknowledgments
The authors wish to thank all individuals and organizations that contributed to the creation of thisdocument.
Patent Disclosure Notice
NOTICE: ITL has requested that holders of patent claims whose use may be required for compliancewith the guidance or requirements of this publication disclose such patent claims to ITL. However,holders of patents are not obligated to respond to ITL calls for patents, and ITL has not undertaken apatent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use
may be required for compliance with the guidance or requirements of this publication, no suchpatent claims have been identified to ITL.
No representation is made or implied by ITL that licenses are not required to avoid patent
infringement in the use of this publication.

ii

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Table of Contents
1

Introduction ............................................................................................................ 1
1.1 The Ransomware Challenge .......................................................................... 1
1.2 Audience ......................................................................................................... 3
1.3 Additional Guidance Resources ...................................................................... 42

The Ransomware Profile ....................................................................................... 5

References ................................................................................................................... 21
Appendix A— Additional NIST Ransomware Resources......................................... 22
This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

iii

NISTIR 8374

1

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Introduction

This Ransomware Profile can help organizations and individuals to manage the risk ofransomware events. That includes helping to gauge an organization’s level of readiness tocounter ransomware threats and to deal with the potential consequences of events. The profile
can also be used to identify opportunities for improving cybersecurity to help thwart
ransomware. It maps security objectives from the Framework for Improving Critical
Infrastructure Cybersecurity, Version 1.1 [1] (also known as the NIST Cybersecurity
Framework) to security capabilities and measures that help to identify, protect against, detect,
respond to, and recover from ransomware events.
This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

1.1

The Ransomware Challenge

Ransomware is a type of malware that encrypts an organization’s data and demands payment asa condition of restoring access to that data. Ransomware can also be used to steal anorganization’s information and demand additional payment in return for not disclosing theinformation to authorities, competitors, or the public. Ransomware attacks target theorganization’s data or critical infrastructure, disrupting or halting operations and posing a
dilemma for management: pay the ransom and hope that the attackers keep their word about
restoring access and not disclosing data, or do not pay the ransom and attempt to restore
operations themselves. The methods ransomware uses to gain access to an organization’s
information and systems are common to cyberattacks more broadly, but they are aimed at forcing
a ransom to be paid. Techniques used to promulgate ransomware will continue to change asattackers constantly look for new ways to pressure their victims.
Ransomware attacks differ from other cybersecurity events where access may be surreptitiously
gained to information such as intellectual property, credit card data, or personally identifiable
information and later exfiltrated for monetization. Instead, ransomware threatens an immediate
impact on business operations. During a ransomware event, organizations may be afforded little
time to mitigate or remediate impact, restore systems, or communicate via necessary business,
partner, and public relations channels. For this reason, it is especially critical that organizations
be prepared. That includes educating users of cyber systems, response teams, and businessdecision makers about the importance of – and processes and procedures for – preventing andhandling potential compromises before they occur.
Fortunately, organizations can follow recommended steps to prepare for and reduce the potential
for successful ransomware attacks. This includes the following: identify and protect critical data,systems, and devices; detect ransomware events as early as possible (preferably before theransomware is deployed); and prepare to respond to and recover from any ransomware events
that do occur. There are many resources available to assist organizations in these efforts. They
include information from the National Institute of Standards and Technology (NIST), the Federal
Bureau of Investigation (FBI), and the Department of Homeland Security (DHS). Additional
NIST resources are listed in Appendix A of this document.
The security capabilities and measures in Table 1 of this profile support a detailed approach topreventing and mitigating ransomware events. Realizing that undertaking all of these measures

1

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

may be beyond the reach of some, the text box below includes basic preventative steps that anorganization can take now to protect against the ransomware threat. Not all of these measures
will apply to the situations of all organizations. The guidance in this report addresses bestpractices rather than a set of legal or regulatory requirements.
BASIC RANSOMWARE TIPS
Even without undertaking all of the measures described in this Ransomware Profile, there aresome basic preventative steps that an organization can take now to protect against and recoverfrom the ransomware threat. These include:
This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

1. Educate employees on avoiding ransomware infections.
oDon’t open files or click on links from unknown sources unless you first run anantivirus scan or look at links carefully.

o

Avoid using personal websites and personal apps – like email, chat, and social media– from work computers.

oDon’t connect personally owned devices to work networks without priorauthorization.

2. Avoid having vulnerabilities in systems that ransomware could exploit.
oKeep relevant systems fully patched. Run scheduled checks to identify available
patches and install these as soon as feasible.

o

Employ zero trust principles in all networked systems. Manage access to all network
functions and segment internal networks where practical to prevent malware fromproliferating among potential target systems.

oAllow installation and execution of authorized apps only. Configure operating
systems and/or third-party software to run only authorized applications. This can also be
supported by adopting a policy for reviewing, then adding or removing authorized
applications on an allow list.

oInform your technology vendors of your expectations (e.g., in contract language) thatthey will apply measures that discourage ransomware attacks.

3. Quickly detect and stop ransomware attacks and infections.
o

Use malware detection software such as antivirus software at all times. Set it toautomatically scan emails and flash drives.

oContinuously monitor directory services (and other primary user stores) for indicatorsof compromise or active attack.

o Block access to untrusted web resources. Use products or services that block access toserver names, IP addresses, or ports and protocols that are known to be malicious orsuspected to be indicators of malicious system activity. This includes using products andservices that provide integrity protection for the domain component of addresses (e.g.,hacker@poser.com).

2

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

4. Make it harder for ransomware to spread.

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

oUse standard user accounts with multi-factor authentication versus accounts withadministrative privileges whenever possible.

oIntroduce authentication delays or configure automatic account lockout as adefense against automated attempts to guess passwords.

oAssign and manage credential authorization for all enterprise assets and software,and periodically verify that each account has only the necessary access following theprinciple of least privilege.

oStore data in an immutable format (so that the database does not automaticallyoverwrite older data when new data is made available).

o

Allow external access to internal network resources via secure virtual private
network (VPN) connections only.

5. Make it easier to recover stored information from a future ransomware event.

1.2oMake an incident recovery plan. Develop, implement, and regularly exercise an
incident recovery plan with defined roles and strategies for decision making. This can bepart of a continuity of operations plan. The plan should identify mission-critical andother business-essential services to enable recovery prioritization, and business
continuity plans for those critical services.

oBack up data, secure backups, and test restoration. Carefully plan, implement, andtest a data backup and restoration strategy—and secure and isolate backups of important
data.

o

Keep your contacts. Maintain an up-to-date list of internal and external contacts forransomware attacks, including law enforcement, legal counsel, and incident response
resources.

Audience

The Ransomware Profile is intended for any organization with cyber resources that could be
subject to ransomware attacks, regardless of sector or size. Any organization – including small to
medium-sized businesses (SMBs), small federal agencies and other small organizations, andoperators of industrial control systems (ICS) or operational technologies (OT) – can leverage thisguidance and is encouraged to also consider reviewing the Cybersecurity Framework.
Many of these actions can be taken without expending considerable resources. Special value may
be gained by organizations that:•are familiar with – and may have already adopted – the NIST Cybersecurity Framework
to help identify, assess, and manage cybersecurity risks and want to improve their risk
postures by addressing ransomware concerns, or•are not familiar with the Cybersecurity Framework but want to implement risk
management frameworks to meet ransomware threats.

3

NISTIR 8374

1.3

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Additional Guidance Resources

In addition to the resources cited earlier in this section, NIST’s National Cybersecurity Center of
Excellence (NCCoE) has produced guidance to support ransomware threat mitigation. NIST has
many other resources that, while not ransomware-specific, contain valuable information about
identifying, protecting against, detecting, responding to, and recovering from ransomware
events. See the References section for a list of references and Appendix A of this profile for amore extensive list of NIST resources.

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

4

NISTIR 8374

2

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILEThe Ransomware Profile

The Ransomware Profile aligns organizations’ ransomware prevention and mitigation
requirements, objectives, risk appetite, and resources with the elements of the NIST
Cybersecurity Framework. It should help organizations to identify and prioritize opportunities
for improving their security and resilience against ransomware attacks. Organizations can use
this document as a guide for profiling the state of their own readiness. Doing so will assist themto determine their current “profile” or state and set a “target profile” to identify gaps.

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

Table 1 defines the Ransomware Profile. The first two columns list relevant Categories andSubcategories from the Cybersecurity Framework that organizations may use as target outcomes
for their ransomware risk management programs. The third column briefly explains how each
Subcategory helps to identify, protect against, detect, respond to, and recover from ransomware
events.
This profile also cites “Informative References.” These are specific sections of standards,
guidelines, and practices common among critical infrastructure sectors that illustrate a method toachieve the outcomes associated with each subcategory. The Informative References in the
Cybersecurity Framework are illustrative and not exhaustive. They are based upon cross-sector
guidance most frequently referenced during the Framework development process.
For example, the second column of Table 1 cites relevant requirements from two of theinformative references included in the Cybersecurity Framework: International Organization forStandardization/International Electrotechnical Commission (ISO/IEC) 27001:2013, Information
technology—Security techniques—Information security management systems—Requirements [2]and NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems andOrganizations [3].
The Cybersecurity Framework lists additional Informative References for each Subcategory.
These references will be updated from time to time in online versions of this guidance document.
The five Cybersecurity Framework Functions used to organize the Categories are:•Identify – Develop an organizational understanding to manage cybersecurity risk tosystems, people, assets, data, and capabilities. The activities in the Identify Function arefoundational for effective use of the Framework. Understanding the business context, theresources that support critical functions, and the related cybersecurity risks enables anorganization to focus and prioritize its efforts, consistent with its risk management
strategy and business needs.

•

Protect – Develop and implement appropriate safeguards to ensure delivery of criticalservices. The Protect Function supports the ability to limit or contain the impact of apotential cybersecurity event.

•Detect – Develop and implement appropriate activities to identify the occurrence of acybersecurity event. The Detect Function enables timely discovery of cybersecurity
events.

5

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE•

Respond – Develop and implement appropriate activities action regarding a detectedcybersecurity incident. The Respond Function supports the ability to contain the impactof a potential cybersecurity incident.

•

Recover – Develop and implement appropriate activities to maintain plans for resilienceand to restore any capabilities or services that were impaired due to a cybersecurity
incident. The Recover Function supports timely recovery to normal operations to reducethe impact from a cybersecurity incident.
Table 1: Ransomware Risk Management Profile

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

Category

Subcategory and Selected
Informative References

Ransomware Application

Identify
Asset Management (ID.AM):
The data, personnel, devices,
systems, and facilities that enable
the organization to achievebusiness purposes are identified
and managed consistent with theirrelative importance toorganizational objectives and theorganization’s risk strategy.

ID.AM-1: Physical devices andsystems within the organization are
inventoried
ISO/IEC 27001:2013 A.8.1.1,
A.8.1.2
NIST SP 800-53 Rev. 5 CM-8, PM5
ID.AM-2: Software platforms andapplications within the organization
are inventoried
ISO/IEC 27001:2013 A.8.1.1,
A.8.1.2
NIST SP 800-53 Rev. 5 CM-8, PM5
ID.AM-3: Organizational
communication and data flows are
mappedISO/IEC 27001:2013 A.13.2.1,
A.13.2.2

An inventory of physical devices
should be undertaken, reviewed, andmaintained to ensure these devices are
not vulnerable to ransomware. It isalso beneficial to have a hardware
inventory during the recovery phases
after a ransomware attack, should a reinstallation of applications benecessary.
Software inventories may track
information such as software nameand version, devices where it iscurrently installed, last patch date, andcurrent known vulnerabilities. This
information supports the remediationof vulnerabilities that could be
exploited in ransomware attacks.
This helps to enumerate what
information or processes are at risk,
should the attackers move laterally
within an environment.

NIST SP 800-53 Rev. 5 AC-4, CA3, CA-9, PL-8
ID.AM-4: External information
systems are catalogued
ISO/IEC 27001:2013 A.11.2.6
NIST SP 800-53 Rev. 5 AC-20,
SA-9

6

This is important for planning
communications to partners andpossible actions to temporarily
disconnect from external systems in
response to ransomware events.
Identifying these connections will also
help organizations plan security
control implementation and identify
areas where controls may be sharedwith third parties.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
ID.AM-5: Resources (e.g.,
hardware, devices, data, time,
personnel, and software) are
prioritized based on theirclassification, criticality, andbusiness value
ISO/IEC 27001:2013 A.8.2.1
NIST SP 800-53 Rev. 5 CP-2, RA2, RA-9, SC-6

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

ID.AM-6: Cybersecurity roles andresponsibilities for the entire
workforce and third-party
stakeholders (e.g., suppliers,
customers, partners) are established
ISO/IEC 27001:2013 A.6.1.1
NIST SP 800-53 Rev. 5 CP-2, PM11, PS-7

Business Environment (ID.BE):
The organization’s mission,
objectives, stakeholders, andactivities are understood andprioritized; this information isused to inform cybersecurity
roles, responsibilities, and risk
management decisions.

ID.BE-2: The organization’s placein critical infrastructure and its
industry sector is identified andcommunicated
ISO/IEC 27001:2013 Clause 4.1
NIST SP 800-53 Rev. 5 PM-8

ID.BE-3: Priorities fororganizational mission, objectives,and activities are established andcommunicated
NIST SP 800-53 Rev. 5 PM-11,
SA-14

7

Ransomware Application
This is essential to understanding thetrue scope and impact of ransomware
events – and is important incontingency planning for future
ransomware events, emergency
response, and recovery actions. It
helps operations and incident
responders to prioritize resources andsupports contingency planning for
future ransomware events, emergency
response, and recovery actions. If
there is an associated industrial
control system (ICS), its critical
functions should be included inemergency response and recovery
actions.
It is important that everyone in theorganization understand their roles
and responsibilities for preventing
ransomware events and, if applicable,
for responding to and recovering fromransomware events. These roles andresponsibilities should be formally
documented in an incident response
plan. The incident response planshould specify regularly exercising theplan (e.g., running incident response
tabletop simulations at least annually).
This allows national computer security
incident response teams to better
understand the targeted organization’splace in the critical infrastructure
environment and permits them to react
in a timely manner in case of crosssector impacts. This also encourages
the organization and its external
stakeholders to consider downstream
effects from the ransomware attack.
This helps operations and incident
responders to prioritize resources. It
supports contingency planning for
future ransomware events, emergency
response, and recovery actions.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
ID.BE-4: Dependencies and critical
functions for delivery of criticalservices are established
ISO/IEC 27001:2013 A.11.2.2,
A.11.2.3, A.12.1.3
NIST SP 800-53 Rev. 5 CP-8, PE9, PE-11, PM-8, SA-20

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

Governance (ID.GV): The
policies, procedures, andprocesses to manage and monitor
the organization’s regulatory,
legal, risk, environmental, andoperational requirements areunderstood and inform the
management of cybersecurity
risk.

ID.GV-1: Organizational
cybersecurity policy is establishedand communicated
ISO/IEC 27001:2013 A.5.1.1
NIST SP 800-53 Rev. 5 AC-01,
AU-01, CA-01, CM-01, CP-01, IA01, IR-01, PE-01, PL-01, PM-01,
RA-01, SA-01, SC-01, SI-01
ID.GV-3: Legal and regulatory
requirements regarding
cybersecurity, including privacy andcivil liberties obligations, areunderstood and managed

Ransomware Application
This helps with identifying secondary
and tertiary components critical in
supporting the organization’s corebusiness functions. This is needed toprioritize contingency plans for future
events and emergency responses toransomware events. If there is anassociated ICS, its critical functions
should be included in emergency
response and recovery actions.
Establishing and communicating
policies needed to prevent or mitigate
ransomware events is essential andfundamental to all other prevention
and mitigation activities. Where
practical, these policies should be
reviewed periodically to reflect the
dynamic nature of risk and the realityof needed ongoing adjustments.
This is necessary for developing
cybersecurity policies and establishingpriorities in contingency planning for
response to future ransomware events.

ISO/IEC 27001:2013 A.18.1.1,
A.18.1.2, A.18.1.3, A.18.1.4,
A.18.1.5
NIST SP 800-53 Rev. 5 CA-07,
RA-02
ID.GV-4: Governance and risk
management processes address
cybersecurity risks
ISO/IEC 27001:2013 Clause 6

Ransomware risks must be factored
into organizational risk management
governance in order to establish
adequate cybersecurity policies.

NIST SP 800-53 Rev. 5 PM-3, PM7, PM-9, PM-10, PM-11, SA-2
Risk Assessment (ID.RA): The
organization understands thecybersecurity risk toorganizational operations(including mission, functions,image, or reputation),organizational assets, andindividuals.

ID.RA-1: Asset vulnerabilities are
identified and documented
ISO/IEC 27001:2013 A.12.6.1,
A.18.2.3
NIST SP 800-53 Rev. 5 CA-2, CA7, CA-8, RA-3, RA-5, SA-5, SA-11,
SI-2, SI-4, SI-5

8

Identifying and documenting thevulnerabilities of the organization’s
assets is crucial in developing plans
for and prioritizing mitigation or
elimination of those vulnerabilities.
These actions also are key tocontingency planning for evaluating
and responding to future ransomware
events and will reduce the likelihoodof a successful ransomware attack.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
ID.RA-2: Cyber threat intelligenceis received from information sharing
forums and sources
ISO/IEC 27001:2013 A.6.1.4
NIST SP 800-53 Rev. 5 PM-15,
PM-16, SI-5
ID.RA-4: Potential business
impacts and likelihoods are
identified

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

ISO/IEC 27001:2013 A.16.1.6,
Clause 6.1.2
NIST SP 800-53 Rev. 5 PM-9, PM11, RA-2, RA-3, SA-20

ID.RA-6: Risk responses are
identified and prioritized
ISO/IEC 27001:2013 Clause 6.1.3
NIST SP 800-53 Rev. 5 PM-4, PM9
Risk Management Strategy(ID.RM): The organization’s
priorities, constraints, risk
tolerances, and assumptions are
established and used to support
operational risk decisions.

ID.RM-1: Risk management
processes are established, managed,
and agreed to by organizational
stakeholders
ISO/IEC 27001:2013 Clause 6.1.3,
Clause 8.3, Clause 9.3
NIST SP 800-53 Rev. 5 PM-4, PM9Supply Chain Risk
Management (ID.SC):
The organization’s priorities,
constraints, risk tolerances, andassumptions are established andused to support risk decisions
associated with managing supply
chain risk. The organization has
established and implemented theprocesses to identify, assess andmanage supply chain risks.

ID.SC-5: Response and recovery
planning and testing are conductedwith suppliers and third-party
providers
ISO/IEC 27001:2013 A.17.1.3
NIST SP 800-53 Rev. 5 CP-2, CP4, IR-3, IR-4, IR-6, IR-8, IR-99Ransomware Application
Receiving and using cyber threat
intelligence from information sharing
sources can reduce the exposure to
ransomware attacks and facilitate
early detection of new threats.

Understanding the business impacts ofpotential ransomware events is needed
to support cybersecurity cost-benefit
analyses as well to establish priorities
for activities in ransomware response
and recovery plans. Understanding
potential business impacts also
supports emergency response
decisions in the event of a ransomware
attack.
The expense associated withresponding to and recovering fromransomware events is directly affectedby the effectiveness of contingency
planning for responses to projectedrisks.
Establishing and enforcing
organizational policies, roles, andresponsibilities depends onstakeholders agreeing to andimplementing effective risk
management processes. The processes
should take into consideration the riskof a ransomware event. These policies
should be reviewed periodically toreflect the dynamic nature of risk andthe reality of needed adjustments overtime.
Ransomware contingency planningshould be coordinated with suppliers
and third-party providers and should
include testing planned activities. The
plan should include a scenario where
the organization, its suppliers, andthird-party providers are all impacted
by ransomware.

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Category

Subcategory and Selected
Informative References

Identity Management,
Authentication and AccessControl (PR.AC): Access tophysical and logical assets andassociated facilities is limited toauthorized users, processes, anddevices, and is managed
consistent with the assessed riskof unauthorized access toauthorized activities andtransactions.

PR.AC-1: Identities and credentials
are issued, managed, verified,
revoked, and audited for authorized
devices, users and processes

Ransomware Application

Protect

ISO/IEC 27001:2013 A.9.2.1,
A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6,
A.9.3.1, A.9.4.2, A.9.4.3

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

NIST SP 800-53 Rev. 5 AC-1, AC2, IA-1, IA-2, IA-3, IA-4, IA-5, IA6, IA-7, IA-8, IA-9, IA-10, IA-11
PR.AC-3: Remote access ismanaged
ISO/IEC 27001:2013 A.6.2.1,
A.6.2.2, A.11.2.6, A.13.1.1,
A.13.2.1
NIST SP 800-53 Rev. 5 AC-1, AC17, AC-19, AC-20, SC-15

PR.AC-4: Access permissions andauthorizations are managed,
incorporating the principles of leastprivilege and separation of duties
ISO/IEC 27001:2013 A.6.1.2,
A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4,
A.9.4.5
NIST SP 800-53 Rev. 5 AC-1, AC2, AC-3, AC-5, AC-6, AC-14, AC16, AC-24

10

Most ransomware attacks are
conducted through network
connections, and ransomware attacks
often start with credential compromise(e.g., unauthorized sharing or captureof login identity and password).
Proper credential management isessential, although not the only
mitigation needed.

Most ransomware attacks are
conducted remotely. Managing
privileges associated with remote
access can help maintain the integrityof systems and data files to protect
against malicious code insertion anddata exfiltration. Using multi-factor
authentication is a key – and easily
implemented – way to reduce thelikelihood of account compromise.
Many ransomware events occur bycompromising user credentials or
invoking processes that haveunnecessary privileged access tosystems. This is a very importantmanagement step for preventing such
events.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
PR.AC-5: Network integrity isprotected (e.g., network segregation,
network segmentation)
ISO/IEC 27001:2013 A.13.1.1,
A.13.1.3, A.13.2.1, A.14.1.2,
A.14.1.3
NIST SP 800-53 Rev. 5 AC-4, AC10, SC-7

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

PR.AC-6: Identities are proofed
and bound to credentials andasserted in interactions
ISO/IEC 27001:2013 A.7.1.1,
A.9.2.1
NIST SP 800-53 Rev. 5 AC-1, AC2, AC-3, AC-16, AC-19, AC-24,
IA-1, IA-2, IA-4, IA-5, IA-8, PE-2,
PS-3
Awareness and Training(PR.AT): The organization’s
personnel and partners areprovided cybersecurity awarenesseducation and are trained toperform their cybersecurityrelated duties and responsibilities
consistent with related policies,
procedures, and agreements.
Data Security (PR.DS):
Information and records (data) aremanaged consistent with theorganization’s risk strategy toprotect the confidentiality,
integrity, and availability of
information.

PR.AT-1: All users are informed
and trained
ISO/IEC 27001:2013 A.7.2.2,
A.12.2.1
NIST SP 800-53 Rev. 5 AT-2, PM13

PR.DS-4: Adequate capacity toensure availability is maintained
ISO/IEC 27001:2013 A.12.1.3,
A.17.2.1
NIST SP 800-53 Rev. 5 AU-4, CP2, SC-5

11

Ransomware Application
Network segmentation or segregation
can limit the scope of ransomware
events by preventing malware fromproliferating among potential target
systems (e.g., moving into an
operational technology or control
system from a business information
technology network). It is critical toseparate IT and OT networks andregularly validate their independence.
This not only reduces the risk of OT
systems being compromised, but also
allows low-level critical operations tocontinue while business IT systems
recover from ransomware. This isparticularly important for critical ICS
functions, including Safety Instrument
Systems (SIS).
Compromised credentials are acommon attack vector in ransomware
events. Identities should be proofed
and then bound to a credential (e.g.,
two-factor authentication of formallyauthorized individuals) to limit thelikelihood that credentials arecompromised or issued to an
unauthorized individual.
Most ransomware attacks are madepossible by users who engage inunsafe practices, administrators who
implement insecure configurations, ordevelopers who have insufficient
security training.

Ensuring adequate availability of data
can reduce ransomware impacts. This
includes the ability to maintain offsite
and offline data backups, testing meantime to recovery and system
redundancy where necessary.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
PR.DS-5: Protections against data
leaks are implemented
ISO/IEC 27001:2013 A.12.1.3,
A.17.2.1
NIST SP 800-53 Rev. 5 AU-4, CP2, SC-5

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

PR.DS-6: Integrity checking
mechanisms are used to verify
software, firmware, and information
integrity

Ransomware Application
Double extortion – demanding
payment both to restore data accessand to not sell or publish the data
elsewhere – is common, so data leakprevention solutions are important.

Integrity checking mechanisms candetect tampered software updates thatcan be used to insert malware thatenables ransomware events.

ISO/IEC 27001:2013 A.12.2.1,
A.12.5.1, A.14.1.2, A.14.1.3,
A.14.2.4
NIST SP 800-53 Rev. 5 SC-16, SI7
PR.DS-7: The development andtesting environment(s) are separate
from the production environment
ISO/IEC 27001:2013 A.12.1.4
NIST SP 800-53 Rev. 5 CM-2
Information Protection
Processes and Procedures(PR.IP): Security policies (thataddress purpose, scope, roles,
responsibilities, management
commitment, and coordination
among organizational entities),
processes, and procedures aremaintained and used to manage
protection of information systems
and assets.

PR.IP-1: A baseline configurationof information technology/industrial
control systems is created andmaintained incorporating security
principles (e.g., concept of least
functionality)
ISO/IEC 27001:2013 A.12.1.2,
A.12.5.1, A.12.6.2, A.14.2.2,
A.14.2.3, A.14.2.4

Keeping development and testing
environments separate fromproduction environments can prevent
ransomware from promulgating fromdevelopment and testing systems into
production systems.
Baselines are useful for establishing
the set of functions a system needs toperform so that any deviation fromthat baseline could be evaluated for its
cyber risk potential. Unauthorizedchanges to the configuration can beused as an indicator of a malicious
attack, which may lead to theintroduction of ransomware.

NIST SP 800-53 Rev. 5 CM-2,
CM-3, CM-4, CM-5, CM-6, CM-7,
CM-9, SA-10
PR.IP-3: Configuration change
control processes are in place
ISO/IEC 27001:2013 A.12.1.2,
A.12.5.1, A.12.6.2, A.14.2.2,
A.14.2.3, A.14.2.4
NIST SP 800-53 Rev. 5 CM-3,
CM-4, SA-10

12Proper configuration change processes
can help to enforce timely security
updates to software, maintainnecessary security configuration
settings, and discourage replacementof code with products that containmalware or do not satisfy accessmanagement policies.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
PR.IP-4: Backups of information
are conducted, maintained, andtestedISO/IEC 27001:2013 A.12.3.1,
A.17.1.2, A.17.1.3, A.18.1.3
NIST SP 800-53 Rev. 5 CP-4, CP6, CP-9This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

PR.IP-9: Response plans (Incident
Response and Business Continuity)and recovery plans (Incident
Recovery and Disaster Recovery)
are in place and managed
ISO/IEC 27001:2013 A.16.1.1,
A.17.1.1, A.17.1.2, A.17.1.3
NIST SP 800-53 Rev. 5 CP-2, CP7, CP-12, CP-13, IR-7, IR-8, IR-9,
PE-17
PR.IP-10: Response and recovery
plans are tested
ISO/IEC 27001:2013 A.17.1.3
NIST SP 800-53 Rev. 5 CP-4, IR-3,
PM-14

Maintenance (PR.MA):
Maintenance and repairs ofindustrial control and information
system components are performed
consistent with policies andprocedures.

PR.MA-2: Remote maintenance oforganizational assets is approved,
logged, and performed in a mannerthat prevents unauthorized access
ISO/IEC 27001:2013 A.11.2.4,
A.15.1.1, A.15.2.1
NIST SP 800-53 Rev. 5 MA-4

13

Ransomware Application
Regular backups that are maintained
and tested are essential to timely andrelatively painless recovery fromransomware events. Backups should
be secured to ensure they cannot
become corrupted by the ransomware
or deleted by the attacker. The
backups should be stored offline.
Response and recovery plans should
include ransomware events. A copy of
the response plan should be kept
offline in case the incident eliminatesaccess to soft copies held within thetargeted network. Ransomware eventsshould be prioritized appropriately
during incident triage with the goal of
immediate containment to prevent theransomware’s spread.
Ransomware response and recovery
plans should be tested periodically toensure that risk and response
assumptions and processes are current
with respect to evolving ransomware
threats. Testing of response andrecovery plans should include any
associated ICS. Processes need to be
updated and maintained to matchchanging organizational needs andstructures as well as new ransomware
types and tactics. Testing trains thepeople who will need to execute theplan.
Remote maintenance provides anaccess channel into networks andtechnology. If not managed properly,
criminals may use this access to alter
configurations to permit introductionof malware. Remote maintenance ofall system components by theorganization or its providers must be
validated to ensure that this process
does not provide backdoor access to
OT or IT networks.

NISTIR 8374

Category
Protective Technology (PR.PT):
Technical security solutions aremanaged to ensure the security
and resilience of systems andassets, consistent with related
policies, procedures, andagreements.

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
PR.PT-1: Audit/log records are
determined, documented,
implemented, and reviewed inaccordance with policy

Ransomware Application
Availability of audit/log records can
assist in detecting unexpectedbehaviors and support forensics
response and recovery processes.

ISO/IEC 27001:2013 A.12.4.1,
A.12.4.2, A.12.4.3, A.12.4.4,
A.12.7.1

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

NIST SP 800-53 Rev. 5 AU-1, AU2, AU-3, AU-4, AU-5, AU-6, AU-7,
AU-8, AU-9, AU-10, AU-12, AU13, AU-14, AU-16
PR.PT-3: The principle of least
functionality is incorporated byconfiguring systems to provide only
essential capabilities
ISO/IEC 27001:2013 A.9.1.2
NIST SP 800-53 Rev. 5 AC-3, CM7

Maintaining the principle of least
functionality may prevent movement
among potential target systems (e.g.,
moving into an operational processcontrol system from an administrative
network).

DetectAnomalies and Events(DE.AE): Anomalous activity isdetected, and the potential impactof events is understood.

DE.AE-3: Event data are collected
and correlated from multiple
sources and sensors
ISO/IEC 27001:2013 A.12.4.1,
A.16.1.7
NIST SP 800-53 Rev. 5 AU-6, CA7, IR-4, IR-5, IR-8, SI-4
DE.AE-4: Impact of events isdetermined
ISO/IEC 27001:2013 A.16.1.4
NIST SP 800-53 Rev. 5 CP-2, IR-4,
RA-3, SI-4

14

Multiple sources and sensors alongwith a Security Information and EventManagement (SIEM) solution
improves network visibility, assists inthe early detection of ransomware, andaids in understanding how
ransomware may propagate through a
network.
Determining the impact of events caninform response and recovery
priorities for a ransomware attack.

NISTIR 8374

Category
Security Continuous
Monitoring (DE.CM): The
information system and assets aremonitored to identify
cybersecurity events and verify
the effectiveness of protective
measures.

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
DE.CM-1: The network ismonitored to detect potential
cybersecurity events
NIST SP 800-53 Rev. 5 AC-2, AU12, CA-7, CM-3, SC-5, SC-7, SI-4
DE.CM-3: Personnel activity ismonitored to detect potential
cybersecurity events

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

ISO/IEC 27001:2013 A.12.4.1,
A.12.4.3

Ransomware Application
Network monitoring might detect
intrusions and initiate protective
actions before malicious code can beinserted or large volumes of
information are encrypted andexfiltrated.
Monitoring personnel activity might
detect insider threats or insecure staff
practices or compromised credentials
and thwart potential ransomware
events.

NIST SP 800-53 Rev. 5 AC-2, AU12, AU-13, CA-7, CM-10, CM-11
DE.CM-4: Malicious code is
detected
ISO/IEC 27001:2013 A.12.2.1
NIST SP 800-53 Rev. 5 SI-3, SI-8

DE.CM-7: Monitoring forunauthorized personnel,
connections, devices, and software
is performed
ISO/IEC 27001:2013 A.12.4.1,
A.14.2.7, A.15.2.1

Detection may indicate that aransomware event is occurring or may
be about to occur. Malicious code isoften not immediately executed, so
there may be time between insertionof malicious code and its activation to
detect it before the ransomware attackis executed.
Unauthorized people, connections,devices, and software are potential
resources from which to launch aransomware attack. Monitoring candetect many ransomware attacks
before they are executed.

NIST SP 800-53 Rev. 5 AU-12,
CA-7, CM-3, CM-8, PE-3, PE-6,
PE-20, SI-4
DE.CM-8: Vulnerability scans are
performed
ISO/IEC 27001:2013 A.12.6.1
NIST SP 800-53 Rev. 5 RA-5
Detection Processes (DE.DP):
Detection processes andprocedures are maintained andtested to ensure awareness ofanomalous events.

DE.DP-1: Roles and responsibilities
for detection are well defined toensure accountability
ISO/IEC 27001:2013 A.6.1.1,
A.7.2.2
NIST SP 800-53 Rev. 5 CA-2, CA7, PM-14

15

Vulnerabilities can be exploitedduring a ransomware attack. Regularscans can allow an organization to
detect and mitigate mostvulnerabilities before they are used to
execute ransomware.
Clear understanding of roles andresponsibilities is key toaccountability and encourages
adherence to organizational policies
and procedures to help detectransomware attacks.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
DE.DP-2: Detection activities
comply with all applicablerequirements

Ransomware Application
Detection activities should be
conducted in adherence toorganization policy and procedures.

ISO/IEC 27001:2013 A.18.1.4,
A.18.2.2, A.18.2.3
NIST SP 800-53 Rev. 5 AC-25,
CA-2, CA-7, PM-14, SI-4, SR-9

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

DE.DP-3: Detection processes aretestedISO/IEC 27001:2013 A.14.2.8
NIST SP 800-53 Rev. 5 CA-2, CA7, PE-3, PM-14, SI-3, SI-4
DE.DP-4: Event detection
information is communicated
ISO/IEC 27001:2013 A.16.1.2,
A.16.1.3
NIST SP 800-53 Rev. 5 AU-6, CA2, CA-7, RA-5, SI-4
DE.DP-5: Detection processes arecontinuously improved
ISO/IEC 27001:2013 A.16.1.6
NIST SP 800-53 Rev. 5 CA-2, CA7, PL-2, PM-14, RA-5, SI-4

Testing provides assurance of correct
detection processes for ransomwarebased attacks, recognizing not that all
intrusion attempts will be detected.
Testing trains the people who willneed to execute the plan.
Timely communication of anomalous
events is necessary for being able totake remedial actions before aransomware attack can be fully
realized.

The tactics used in ransomware
attacks are continuously being refined,
so detection processes must
continuously evolve to keep up withnew threats.

Respond
Response Planning (RS.RP):
Response processes andprocedures are executed andmaintained to ensure response todetected cybersecurity incidents.

RS.RP-1: Response plan is
executed during or after an incident
ISO/IEC 27001:2013 A.16.1.5
NIST SP 800-53 Rev. 5 CP-2, CP10, IR-4, IR-8

16

Immediate execution of the response
plan’s public relations andcommunications response components
is necessary to stop any corruption orcontinuing exfiltration of data, stem
the spread of an infection to othersystems and networks, and initiate
preemptive messaging to minimize
further damage, including reputationalor legal harm.

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Category

Subcategory and Selected
Informative References

Communications (RS.CO):
Response activities arecoordinated with internal andexternal stakeholders (e.g.,
support from law enforcement
agencies).

RS.CO-1: Personnel know theirroles and order of operations when a
response is needed
ISO/IEC 27001:2013 A.6.1.1,
A.7.2.2, A.16.1.1
NIST SP 800-53 Rev. 5 CP-2, CP3, IR-3, IR-8

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

RS.CO-2: Incidents are reported
consistent with established criteria
ISO/IEC 27001:2013 A.6.1.3,
A.16.1.2
NIST SP 800-53 Rev. 5 AU-6, IR6, IR-8
RS.CO-3: Information is sharedconsistent with response plans
ISO/IEC 27001:2013 A.16.1.2,
Clause 7.4, Clause 16.1.2

Ransomware Application
Response to ransomware events
includes both technical and business
responses. An effective and efficient
response requires all parties tounderstand their roles andresponsibilities. Communications
response roles should be formally
documented in incident response andrecovery plans and should be
reinforced by exercising the plans.
Response to ransomware events
includes both technical and business
responses. An effective and efficient
response requires pre-establishedcriteria for reporting and adherence tothose criteria during an event.
Information sharing priorities include
stemming the spread of an infection toother systems and networks as well as
preemptive messaging.

NIST SP 800-53 Rev. 5 CA-2, CA7, CP-2, IR-4, IR-8, PE-6, RA-5, SI4
RS.CO-4: Coordination withstakeholders occurs consistent withresponse plans
ISO/IEC 27001:2013 Clause 7.4
NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8
RS.CO-5: Voluntary information
sharing occurs with external
stakeholders to achieve broader
cybersecurity situational awareness
ISO/IEC 27001:2013 A.6.1.4
NIST SP 800-53 Rev. 5 PM-15, SI5
Analysis (RS.AN): Analysis isconducted to ensure effective
response and support recovery
activities.

RS.AN-1: Notifications fromdetection systems are investigated
ISO/IEC 27001:2013 A.12.4.1,
A.12.4.3, A.16.1.5
NIST SP 800-53 Rev. 5 AU-6, CA7, IR-4, IR-5, PE-6, SI-4

17

Coordination with key internal andexternal stakeholders is important forpriorities such as stemming the spreadof misinformation and establishingpreemptive messaging.

Information sharing may yieldforensic benefits and reduce theimpact and profitability ofransomware attacks. Voluntary
sharing should complement any
regulatory or other compliancerequirements for reporting andsharing.
Notifications from detection systems
should be promptly and fully
investigated, as these may often
indicate a ransomware attack in its
early stages so that it can bepreempted or so impacts can be
mitigated.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
RS.AN-2: The impact of theincident is understood
ISO/IEC 27001:2013 A.16.1.4,
A.16.1.6
NIST SP 800-53 Rev. 5 CP-2, IR-4

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

RS.AN-3: Forensics are performed
ISO/IEC 27001:2013 A.16.1.7
NIST SP 800-53 Rev. 5 AU-7, IR-4

RS.AN-5: Processes are established
to receive, analyze and respond tovulnerabilities disclosed to theorganization from internal andexternal sources (e.g., internal
testing, security bulletins, or
security researchers)

Ransomware Application
Understanding impact will shape theimplementation of the recovery plan.
Organizations should seek tounderstand the technical impact of aransomware attack (e.g., what systems
are unavailable) and then understandthe resulting impact on the business(e.g., which business processes can’t
be delivered). This will help to ensurethat the response and recovery effort isproperly prioritized and resourced,
and business continuity plans can be
implemented in the meantime.
Forensics help identify the root cause
to contain and eradicate the attack,including things like resetting
passwords of credentials stolen by theattacker, deleting malware used by theattacker, and removing persistencemechanisms used by the attacker.
Forensics can also inform the recovery
process and assist with reporting andsharing actions.
Analysis processes can prevent future
successful attacks and the spread of
the ransomware to other systems andnetworks. It can also help restore
confidence among stakeholders.

NIST SP 800-53 Rev. 5 PM-15, SI5
Mitigation (RS.MI): Activities
are performed to prevent
expansion of an event, mitigate its
effects, and resolve the incident.

RS.MI-1: Incidents are contained
ISO/IEC 27001:2013 A.12.2.1,
A.16.1.5
NIST SP 800-53 Rev. 5 IR-4
RS.MI-2: Incidents are mitigated
ISO/IEC 27001:2013 A.12.2.1,
A.16.1.5
NIST SP 800-53 Rev. 5 IR-4

18

Immediate action must be taken toprevent the spread of the ransomware
to other systems and networks,
mitigate its effects, and resolve theincident. Containment of ransomware
includes any associated ICS.
Immediate action must be taken toisolate the ransomware in order tominimize damage to data, prevent theinfection from spreading within the
network and to other systems andnetworks, and minimize the impact on
the mission or business.

NISTIR 8374

Category

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
RS.MI-3: Newly identified
vulnerabilities are mitigated or
documented as accepted risks
ISO/IEC 27001:2013 A.12.6.1
NIST SP 800-53 Rev. 5 IR-4

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

Improvements (RS.IM):
Organizational response activities
are improved by incorporating
lessons learned from current andprevious detection/response
activities.

RS.IM-1: Response plansincorporate lessons learned
ISO/IEC 27001:2013 A.16.1.6,
Clause 10

Ransomware Application
Vulnerability management minimizes
the probability of successful
ransomware attacks. If vulnerabilities
cannot be patched or mitigated,documenting this risk at least allows
for its inclusion in future decision
making and provides transparency forstakeholders that might be impacted
by ransomware events.
This minimizes the probability of
future successful ransomware attacks
and can help to restore confidence
among stakeholders.

NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8
RS.IM-2: Response strategies are
updated
ISO/IEC 27001:2013 A.16.1.6,
Clause 10

This minimizes the probability of
future successful ransomware attacks
and can help to restore confidence
among stakeholders.

NIST SP 800-53 Rev 5 CP-2, IR-4,
IR-8

Recover
Recovery Planning (RC.RP):
Recovery processes andprocedures are executed andmaintained to ensure restorationof systems or assets affected bycybersecurity incidents.

RC.RP-1: Recovery plan is
executed during or after acybersecurity incident

Improvements (RC.IM):
Recovery planning and processes
are improved by incorporating
lessons learned into future
activities.

RC.IM-1: Recovery plansincorporate lessons learned

Immediately initiating the recovery
plan after the root cause has been
identified can cut losses.

ISO/IEC 27001:2013 A.16.1.5
NIST SP 800-53 Rev. 5 CP-10, IR4, IR-8

ISO/IEC 27001:2013 A.16.1.6,
Clause 10

This minimizes the probability of
future successful ransomware attacks
and can help to restore confidence
among stakeholders.

NIST SP 800-53 Rev 5 CP-2, IR-4,
IR-8
RC.IM-2: Recovery strategies are
updated
ISO/IEC 27001:2013 A.16.1.6,
Clause 10
NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8

19

This is needed to maintain theeffectiveness of contingency planningfor future ransomware attacks.

NISTIR 8374

Category
Communications (RC.CO):
Restoration activities arecoordinated with internal andexternal parties (e.g. coordinating
centers, Internet Service
Providers, owners of attacking
systems, victims, other CSIRTs,
and vendors).

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE
Subcategory and Selected
Informative References
RC.CO-1: Public relations aremanaged
ISO/IEC 27001:2013 A.6.1.4,
Clause 7.4
RC.CO-2: Reputation is repaired
after an incident
ISO/IEC 27001:2013 Clause 7.4

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

RC.CO-3: Recovery activities arecommunicated to internal andexternal stakeholders as well as
executive and management teams
ISO/IEC 27001:2013 Clause 7.4
NIST SP 800-53 Rev. 5 CP-2, IR-4

20

Ransomware Application
This minimizes the business impact by
being open and transparent andrestores confidence among
stakeholders.
Reputational repair minimizes thebusiness impact and restoresconfidence among stakeholders.
Communication about recovery
activities helps to minimize thebusiness impact and restore
confidence among stakeholders.

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

References

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374[1]

National Institute of Standards and Technology (2018) Framework for Improving Critical
Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards andTechnology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018[2]International Organization for Standardization/International Electrotechnical Commission(ISO/IEC) (2013) ISO/IEC 27001:2013 – Information technology – Security techniques –Information security management systems – Requirements (ISO, Geneva, Switzerland).
Available at https://www.iso.org/isoiec-27001-information-security.html[3]

Joint Task Force (2020) Security and Privacy Controls for Information Systems andOrganizations. (National Institute of Standards and Technology, Gaithersburg, MD),NIST Special Publication (SP) 800-53, Rev. 5. Includes updates as of December 10,
2020. https://doi.org/10.6028/NIST.SP.800-53r5

21

NISTIR 8374

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Appendix A—Additional NIST Ransomware Resources

In addition to other resources cited in this document, NIST’s National Cybersecurity Center of
Excellence (NCCoE) has produced additional guidance to support ransomware threat mitigation.
These include:

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374•

NIST Special Publication (SP) 1800-26, Data Integrity: Detecting and Responding to
Ransomware and Other Destructive Events addresses how an organization can handle anattack when it occurs and what capabilities it needs to have in place to detect and respondto destructive events.

•

NIST SP 1800-25, Data Integrity: Identifying and Protecting Assets Against
Ransomware and Other Destructive Events addresses how an organization can work
before an attack to identify its assets and potential vulnerabilities and remedy thediscovered vulnerabilities to protect these assets.

•

NIST SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive
Events addresses approaches for recovery should a data integrity attack be successful.

•Protecting Data from Ransomware and Other Data Loss Events is a guide for managed
service providers to conduct, maintain, and test backup files that are critical to recoveringfrom ransomware attacks.

NIST has many other resources that, while not ransomware-specific, contain valuable
information about identifying, protecting against, detecting, responding to, and recovering fromransomware events. Several are highlighted below. For a more complete list of resources, visit
NIST’s Ransomware Protection and Response site at https://csrc.nist.gov/ransomware.
•

Improving the security of telework, remote access, and bring-your-own-device(BYOD) technologies:o Telework: Working Anytime, Anywhere projecto NIST SP 800-46 Revision 2, Guide to Enterprise Telework, Remote Access, andBring Your Own Device (BYOD) Security•

Patching software to eliminate vulnerabilities:
o NIST SP 800-40 Revision 3, Guide to Enterprise Patch Management
Technologies
o Critical Cybersecurity Hygiene: Patching the Enterprise project•

Using application control technology to prevent ransomware execution:o NIST SP 800-167, Guide to Application Whitelisting•

Finding low-level guidance on securely configuring software to eliminate
vulnerabilities:o National Checklist Program

22

NISTIR 8374•

RANSOMWARE RISK MANAGEMENT:A CYBERSECURITY FRAMEWORK PROFILE

Getting the latest information on known vulnerabilities:o National Vulnerability Database•

Planning for cybersecurity event recovery:o NIST SP 800-184, Guide for Cybersecurity Event Recovery•

Contingency planning for restoring operations after a disruption caused byransomware:o NIST SP 800-34 Revision 1, Contingency Planning Guide for Federal
Information Systems

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374•

Handling ransomware and other malware incidents:
o NIST SP 800-83 Revision 1, Guide to Malware Incident Prevention and Handlingfor Desktops and Laptops•

Handling cybersecurity incidents in general:o NIST SP 800-61 Revision 2, Computer Security Incident Handling Guide•

Getting started with cybersecurity risk management:o Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide

23