Draft NISTIR 8374

Cybersecurity Framework Profile for
Ransomware Risk Management
William C. Barker
Karen Scarfone
William Fisher
Murugiah Souppaya

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374-draftDraft NISTIR 8374

Cybersecurity Framework Profile for
Ransomware Risk Management
William C. Barker

William Fisher

Dakota Consulting
Silver Spring, MD

Applied Cybersecurity Division
Information Technology Laboratory

Karen Scarfone

Murugiah Souppaya

Scarfone Cybersecurity
Clifton, VA

Computer Security Division
Information Technology Laboratory

This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374-draft

September 2021

U.S. Department of Commerce
Gina M. Raimondo, Secretary1

National Institute of Standards and Technology
James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce
for Standards and Technology & Director, National Institute of Standards and Technology

23National Institute of Standards and Technology Interagency or Internal Report 8374

45This publication is available free of charge from:https://doi.org/10.6028/NIST.IR.8374-draft

6
7
8
9
10
11
12
13
14
15
16
17
18

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best
available for the purpose.

19
20
21
22
23

Public comment period: September 8, 2021 through October 8, 2021

24

All comments are subject to release under the Freedom of Information Act (FOIA).

25 pages (September 2021)

There may be references in this publication to other publications currently under development by NIST in accordancewith its assigned statutory responsibilities. The information in this publication, including concepts and methodologies,
may be used by federal agencies even before the completion of such companion publications. Thus, until eachpublication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For
planning and transition purposes, federal agencies may wish to closely follow the development of these new
publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to
NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.

National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000
Email: ransomware@nist.gov

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

25

Reports on Computer Systems Technology

26
27
28
29
30
31
32
33

The Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advance thedevelopment and productive use of information technology. ITL’s responsibilities include thedevelopment of management, administrative, technical, and physical standards and guidelines forthe cost-effective security and privacy of other than national security-related information in federal
information systems.

34

Abstract

35
36
37
38
39
40
41
42

Ransomware is a type of malicious attack where attackers encrypt an organization’s data anddemand payment to restore access. In some instances, attackers may also steal an organization’s
information and demand an additional payment in return for not disclosing the information toauthorities, competitors, or the public. This Ransomware Profile identifies the Cybersecurity
Framework Version 1.1 security objectives that support preventing, responding to, and recoveringfrom ransomware events. The profile can be used as a guide to managing the risk of ransomware
events. That includes helping to gauge an organization's level of readiness to counter ransomware
threats and to deal with the potential consequences of events.

43

Keywords

44

Cybersecurity Framework; detect; identify; protect; ransomware; recover; respond; risk; security.

45

Acknowledgments

46
47

The authors wish to thank all individuals and organizations that contributed to the creation of thisdocument.

48

ii

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

49

Call for Patent Claims

50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

This public review includes a call for information on essential patent claims (claims whose use
would be required for compliance with the guidance or requirements in this Information
Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may bedirectly stated in this ITL Publication or by reference to another publication. This call also
includes disclosure, where known, of the existence of pending U.S. or foreign patent applications
relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents.
ITL may require from the patent holder, or a party authorized to make assurances on its behalf,in written or electronic form, either:a) assurance in the form of a general disclaimer to the effect that such party does not holdand does not currently intend holding any essential patent claim(s); orb) assurance that a license to such essential patent claim(s) will be made available toapplicants desiring to utilize the license for the purpose of complying with the guidanceor requirements in this ITL draft publication either:i.
ii.

under reasonable terms and conditions that are demonstrably free of any unfair
discrimination; orwithout compensation and under reasonable terms and conditions that aredemonstrably free of any unfair discrimination.

Such assurance shall indicate that the patent holder (or third party authorized to make assuranceson its behalf) will include in any documents transferring ownership of patents subject to theassurance, provisions sufficient to ensure that the commitments in the assurance are binding on
the transferee, and that the transferee will similarly include appropriate provisions in the event of
future transfers with the goal of binding each successor-in-interest.
The assurance shall also indicate that it is intended to be binding on successors-in-interest
regardless of whether such provisions are included in the relevant transfer documents.
Such statements should be addressed to: ransomware@nist.gov

iii

NISTIR 8374 (DRAFT)

Table of Contents

83
84

CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

1Introduction ............................................................................................................ 185

1.1 The Ransomware Challenge .......................................................................... 186

1.2 Audience ......................................................................................................... 287

1.3 Additional Resources ...................................................................................... 3

88

2

The Ransomware Profile ....................................................................................... 589

References ................................................................................................................... 20

90

iv

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

91

1

Introduction

92
93
94
95
96
97
98
99

The Ransomware Profile defined in this report maps security objectives from the Framework for
Improving Critical Infrastructure Cybersecurity, Version 1.1 [1] (also known as the
Cybersecurity Framework) to security capabilities and measures that support preventing,responding to, and recovering from ransomware events. The profile can be used as a guide to
managing the risk of ransomware events. That includes helping to gauge an organization's levelof readiness to mitigate ransomware threats and to react to the potential impact of events. The
profile can also be used to identify opportunities for improving cybersecurity to help thwart
ransomware.

100

1.1

101
102
103
104
105
106
107
108
109
110
111

Ransomware is a type of malware that encrypts an organization’s data and demands payment asa condition of restoring access to that data. In some instances, ransomware may also steal anorganization’s information and demand an additional payment in return for not disclosing theinformation to authorities, competitors, or the public. Ransomware attacks target theorganization’s data or critical infrastructure, disrupting or halting operations and posing a
dilemma for management: pay the ransom and hope that the attackers keep their word about
restoring access and not disclosing data, or do not pay the ransom and restore operations
themselves. The methods ransomware uses to gain access to an organization’s information andsystems are common to cyberattacks more broadly, but they are aimed at forcing a ransom to be
paid. Techniques used to promulgate ransomware will continue to change as attackers constantly
look for new ways to increase pressure on their victims.

112
113
114
115
116
117
118

Fortunately, organizations can follow recommended steps to prepare for and reduce the potential
for successful ransomware attacks. This includes identifying and protecting critical data,systems, and devices; detecting ransomware events as early as possible (preferably before theransomware is deployed); and preparing for responses to and recovery from any ransomware
events that do occur. There are many resources available to assist organizations in these efforts.
They include information from the National Institute of Standards and Technology (NIST), theFederal Bureau of Investigation (FBI), and the Department of Homeland Security (DHS).

119
120
121
122

The security capabilities and measures in this profile support a detailed approach to preventing
and mitigating ransomware events. Even without undertaking all of these measures, there aresome basic preventative steps that an organization can take now to protect against theransomware threat. These include:

The Ransomware Challenge

123
124

•

Use antivirus software at all times. Set your software to automatically scan emails andflash drives.

125
126

•

Keep computers fully patched. Run scheduled checks to identify available patches, andinstall these as soon as feasible.

127
128

•

Segment networks. Segment internal networks to prevent malware from proliferating
among potential target systems.

129
130

•

Continuously monitor directory services (and other primary user stores) for indicatorsof compromise or active attack.
1

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

131
132
133

•

Block access to potentially malicious web resources. Use products or services thatblock access to server names, IP addresses, or ports and protocols that are known to bemalicious or suspected to be indicators of malicious system activity.

134
135
136

•

Allow only authorized apps. Configure operating systems and/or third-party software to
run only authorized applications. Establish processes for reviewing, then adding or
removing authorized applications on an allowlist.

137
138

•

Use standard user accounts versus accounts with administrative privileges wheneverpossible.

139•

Restrict personally owned devices on work networks.

140•

Avoid using personal apps—like email, chat, and social media—from work computers.

141
142

•

Educate employees about social engineering. Don’t open files or click on links fromunknown sources unless you first run an antivirus scan or look at links carefully.

143
144

•

Assign and manage credential authorization for all enterprise assets and software, andperiodically verify that each account has the appropriate access only.

145

Steps that organizations can take now to help recover from a future ransomware event include:

146
147
148
149

•

Make an incident recovery plan. Develop and implement an incident recovery planwith defined roles and strategies for decision making. This can be part of a continuity ofoperations plan. The plan should identify business-critical services to enable recovery
prioritization, and business continuity plans for those critical services.

150
151

•

Backup data, secure backups, and test restoration. Carefully plan, implement, and test
a data backup and restoration strategy—and secure and isolate backups of important data.

152
153

•

Keep your contacts. Maintain an up-to-date list of internal and external contacts forransomware attacks, including law enforcement.

154

1.2

155
156

The Ransomware Profile is intended for a general audience and is broadly applicable toorganizations that:

Audience

157
158

•

have already adopted the NIST Cybersecurity Framework to help identify, assess, andmanage cybersecurity risks;

159
160

•

are familiar with the Cybersecurity Framework and want to improve their risk postures;
or

161
162

•

are unfamiliar with the Cybersecurity Framework but need to implement risk
management frameworks to meet ransomware threats.

163
164
165

Organizations such as small to medium-sized businesses (SMBs) and operators of industrial
control systems (ICS) or operational technologies (OT) may also leverage this guidance and the
Cybersecurity Framework.

2

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

166

1.3

167
168

NIST’s National Cybersecurity Center of Excellence (NCCoE) has produced additional referencematerials intended to support ransomware threat mitigation. These references include:

Additional Resources

169
170
171
172

•

NIST Special Publication (SP) 1800-26, Data Integrity: Detecting and Responding to
Ransomware and Other Destructive Events addresses how an organization can handle anattack when it occurs, and what capabilities it needs to have in place to detect andrespond to destructive events.

173
174
175
176

•

NIST SP 1800-25, Data Integrity: Identifying and Protecting Assets Against
Ransomware and Other Destructive Events addresses how an organization can work
before an attack to identify its assets and potential vulnerabilities and remedy thediscovered vulnerabilities to protect these assets.

177
178

•

NIST SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive
Events addresses approaches for recovery should a data integrity attack be successful.

179
180
181

•

Protecting Data from Ransomware and Other Data Loss Events is a guide for managed
service providers to conduct, maintain, and test backup files that are critical to recoveringfrom ransomware attacks.

182
183
184
185
186
187
188

NIST has many other resources that, while not ransomware-specific, contain valuable
information about preventing, preparing for, detecting, and responding and recovering fromransomware events. Several of these resources are highlighted below. For the complete list ofresources, visit NIST’s Ransomware Protection and Response site athttps://csrc.nist.gov/ransomware.
•

189

o Telework: Working Anytime, Anywhere project

190
191
192

Improving the security of telework, remote access, and bring-your-own-device(BYOD) technologies:o•

NIST SP 800-46 Revision 2, Guide to Enterprise Telework, Remote Access, andBring Your Own Device (BYOD) Security

Patching software to eliminate vulnerabilities:

193
194

o NIST SP 800-40 Revision 3, Guide to Enterprise Patch Management
Technologies

195

o Critical Cybersecurity Hygiene: Patching the Enterprise project

196

•

197
198
199

o NIST SP 800-167, Guide to Application Whitelisting

•

200
201
202

Using application control technology to prevent ransomware execution:
Finding low-level guidance on securely configuring software to eliminate
vulnerabilities:o National Checklist Program•

Getting the latest information on known vulnerabilities:o National Vulnerability Database
3

NISTIR 8374 (DRAFT)

203

•

204
205
206

•

213

Contingency planning for restoring operations after a disruption caused byransomware:o NIST SP 800-34 Revision 1, Contingency Planning Guide for Federal
Information Systems

•

210
211
212

Planning for cybersecurity event recovery:o NIST SP 800-184, Guide for Cybersecurity Event Recovery

207
208
209

CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

Handling ransomware and other malware incidents:
o NIST SP 800-83 Revision 1, Guide to Malware Incident Prevention and Handlingfor Desktops and Laptops•

Handling cybersecurity incidents in general:o NIST SP 800-61 Revision 2, Computer Security Incident Handling Guide

4

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

214

2

The Ransomware Profile

215
216
217
218
219
220
221

The Ransomware Profile aligns organizations’ ransomware prevention and mitigation
requirements, objectives, risk appetite, and resources with the elements of the Cybersecurity
Framework. The purpose of the profile is to help organizations identify and prioritize
opportunities for improving their security and resilience against ransomware attacks.
Organizations can use this document as a guide for profiling the state of their own readiness. For
example, they can determine their current state and set a target profile to identify gaps to achieve
their goal.

222
223
224
225

Table 1 defines the Ransomware Profile. The first two columns of the table list the relevant
Categories and Subcategories from the Cybersecurity Framework. The third column briefly
explains how each of the listed Subcategories supports preventing, responding to, and recoveringfrom ransomware events.

226
227
228
229
230
231
232

The second column of Table 1 also cites relevant requirements from two of the informativereferences included in the Cybersecurity Framework: International Organization forStandardization/International Electrotechnical Commission (ISO/IEC) 27001:2013, Information
technology—Security techniques—Information security management systems—Requirements [2]and NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems andOrganizations [3]. Additional informative references may be included in subsequent versions of
this report.

233
234
235
236
237
238

The Cybersecurity Framework lists additional Informative References for each Subcategory.
Informative References are specific sections of standards, guidelines, and practices common
among critical infrastructure sectors that illustrate a method to achieve the outcomes associatedwith each subcategory. The Informative References in the Cybersecurity Framework areillustrative and not exhaustive. They are based upon cross-sector guidance most frequently
referenced during the Framework development process.

239

The five Cybersecurity Framework Functions that are used to organize the Categories are:

240
241
242
243
244
245

•

Identify – Develop an organizational understanding to manage cybersecurity risk tosystems, people, assets, data, and capabilities. The activities in the Identify Function arefoundational for effective use of the Framework. Understanding the business context, theresources that support critical functions, and the related cybersecurity risks enables anorganization to focus and prioritize its efforts, consistent with its risk management
strategy and business needs.

246
247
248

•

Protect – Develop and implement appropriate safeguards to ensure delivery of criticalservices. The Protect Function supports the ability to limit or contain the impact of apotential cybersecurity event.

249
250
251

•

Detect – Develop and implement appropriate activities to identify the occurrence of acybersecurity event. The Detect Function enables timely discovery of cybersecurity
events.

5

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

252
253
254

•

Respond – Develop and implement appropriate activities to take action regarding a
detected cybersecurity incident. The Respond Function supports the ability to contain theimpact of a potential cybersecurity incident.

255
256
257
258

•

Recover – Develop and implement appropriate activities to maintain plans for resilienceand to restore any capabilities or services that were impaired due to a cybersecurity
incident. The Recover Function supports timely recovery to normal operations to reducethe impact from a cybersecurity incident.

259

Table 1: Ransomware Profile

Category

Subcategory and Selected
Informative References

Ransomware Application

Identify
Asset Management (ID.AM):
The data, personnel, devices,
systems, and facilities that enable
the organization to achievebusiness purposes are identified
and managed consistent with theirrelative importance toorganizational objectives and theorganization’s risk strategy.

ID.AM-1: Physical devices andsystems within the organization are
inventoried
ISO/IEC 27001:2013 A.8.1.1,
A.8.1.2
NIST SP 800-53 Rev. 5 CM-8, PM5
ID.AM-2: Software platforms andapplications within the organization
are inventoried
ISO/IEC 27001:2013 A.8.1.1,
A.8.1.2
NIST SP 800-53 Rev. 5 CM-8, PM5
ID.AM-3: Organizational
communication and data flows are
mappedISO/IEC 27001:2013 A.13.2.1,
A.13.2.2

An inventory of physical devices
should be undertaken, reviewed, andmaintained to ensure there is no
unprotected vector for a ransomware
attack. It is also appropriate to have a
hardware inventory during therecovery phases after a ransomware
attack, should a re-installation of
applications be necessary.
Software inventories may track
information such as software nameand version, devices where it’scurrently installed, last patch date, andcurrent known vulnerabilities. This
information supports the remediationof vulnerabilities that could be
exploited in ransomware attacks.
This helps to enumerate what
information or processes are at risk,
should the attackers move laterally
within an environment.

NIST SP 800-53 Rev. 5 AC-4, CA3, CA-9, PL-8
ID.AM-4: External information
systems are catalogued
ISO/IEC 27001:2013 A.11.2.6
NIST SP 800-53 Rev. 5 AC-20,
SA-9

6

This is important for planning
communications to partners andpossible actions to temporarily
disconnect from external systems in
response to ransomware events.
Identifying these connections will also
help organizations plan security
control implementation and identify
areas where controls may be sharedwith third parties.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
ID.AM-5: Resources (e.g.,
hardware, devices, data, time,
personnel, and software) are
prioritized based on theirclassification, criticality, andbusiness value
ISO/IEC 27001:2013 A.8.2.1
NIST SP 800-53 Rev. 5 CP-2, RA2, RA-9, SC-6

ID.AM-6: Cybersecurity roles andresponsibilities for the entire
workforce and third-party
stakeholders (e.g., suppliers,
customers, partners) are established
ISO/IEC 27001:2013 A.6.1.1
NIST SP 800-53 Rev. 5 CP-2, PM11, PS-7
Business Environment (ID.BE):
The organization’s mission,
objectives, stakeholders, andactivities are understood andprioritized; this information isused to inform cybersecurity
roles, responsibilities, and risk
management decisions.

ID.BE-2: The organization’s placein critical infrastructure and its
industry sector is identified andcommunicated
ISO/IEC 27001:2013 Clause 4.1
NIST SP 800-53 Rev. 5 PM-8

ID.BE-3: Priorities fororganizational mission, objectives,and activities are established andcommunicated
NIST SP 800-53 Rev. 5 PM-11,
SA-14

7

Ransomware Application
This is essential to understanding thetrue scope and impact of ransomware
events, and is an important factor incontingency planning for future
ransomware events, emergency
responses, and recovery actions. This
helps operations and incident
responders with prioritizing resources.
This supports contingency planningfor future ransomware events,
emergency responses, and recovery
actions. If there is an associatedindustrial control system (ICS), thenits critical functions should be
included in emergency responses andrecovery actions.
It’s important that everyone in theorganization understand their roles
and responsibilities for preventing
ransomware events and, if applicable,
also for responding to and recoveringfrom ransomware events. These roles
and responsibilities should be formally
documented in an incident
response/recovery plan.
Allows national computer security
incident response teams to better
understand the targeted organization’splace in the critical infrastructure
environment, in order to react timely
in case of cross-sector impacts. This
also encourages the organization itself
and its external stakeholders toconsider downstream effects from theransomware attack.
This helps operations and incident
responders with prioritizing resources.
This supports contingency planningfor future ransomware events,
emergency responses, and recovery
actions.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
ID.BE-4: Dependencies and critical
functions for delivery of criticalservices are established
ISO/IEC 27001:2013 A.11.2.2,
A.11.2.3, A.12.1.3
NIST SP 800-53 Rev. 5 CP-8, PE9, PE-11, PM-8, SA-20

Governance (ID.GV): The
policies, procedures, andprocesses to manage and monitor
the organization’s regulatory,
legal, risk, environmental, andoperational requirements areunderstood and inform the
management of cybersecurity
risk.

ID.GV-1: Organizational
cybersecurity policy is establishedand communicated
ISO/IEC 27001:2013 A.5.1.1
NIST SP 800-53 Rev. 5 AC-01,
AU-01, CA-01, CM-01, CP-01, IA01, IR-01, PE-01, PL-01, PM-01,
RA-01, SA-01, SC-01, SI-01
ID.GV-3: Legal and regulatory
requirements regarding
cybersecurity, including privacy andcivil liberties obligations, areunderstood and managed

Ransomware Application
This helps with identifying secondary
and tertiary components that are
critical in supporting theorganization’s core business functions.
This is needed to prioritize
contingency plans for future eventsand emergency responses toransomware events. If there is anassociated industrial control system(ICS), then its critical functions should
be included in emergency responses
and recovery actions.
Establishing and communicating
policies needed to prevent or mitigate
ransomware events is essential andfundamental to all other prevention
and mitigation activities.

This is necessary for cybersecurity
policy development and forestablishing priorities in contingency
planning for responses to future
ransomware events.

ISO/IEC 27001:2013 A.18.1.1,
A.18.1.2, A.18.1.3, A.18.1.4,
A.18.1.5
NIST SP 800-53 Rev. 5 CA-07,
RA-02
ID.GV-4: Governance and risk
management processes address
cybersecurity risks
ISO/IEC 27001:2013 Clause 6

Ransomware risks must be factored
into organizational risk management
governance in order to establish
adequate cybersecurity policies.

NIST SP 800-53 Rev. 5 PM-3, PM7, PM-9, PM-10, PM-11, SA-2
Risk Assessment (ID.RA): The
organization understands thecybersecurity risk toorganizational operations(including mission, functions,image, or reputation),organizational assets, andindividuals.

ID.RA-1: Asset vulnerabilities are
identified and documented
ISO/IEC 27001:2013 A.12.6.1,
A.18.2.3
NIST SP 800-53 Rev. 5 CA-2, CA7, CA-8, RA-3, RA-5, SA-5, SA-11,
SI-2, SI-4, SI-5

8

Identifying and documenting thevulnerabilities of the organization’s
assets supports developing plans forand prioritizing the mitigation or
elimination of those vulnerabilities, aswell as contingency planning forevaluating and responding to future
ransomware events. This will reduce
the likelihood of a ransomware
outbreak.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
ID.RA-2: Cyber threat intelligenceis received from information sharing
forums and sources
ISO/IEC 27001:2013 A.6.1.4
NIST SP 800-53 Rev. 5 PM-15,
PM-16, SI-5
ID.RA-4: Potential business
impacts and likelihoods are
identified
ISO/IEC 27001:2013 A.16.1.6,
Clause 6.1.2
NIST SP 800-53 Rev. 5 PM-9, PM11, RA-2, RA-3, SA-20

ID.RA-6: Risk responses are
identified and prioritized
ISO/IEC 27001:2013 Clause 6.1.3
NIST SP 800-53 Rev. 5 PM-4, PM9
Risk Management Strategy(ID.RM): The organization’s
priorities, constraints, risk
tolerances, and assumptions are
established and used to support
operational risk decisions.

ID.RM-1: Risk management
processes are established, managed,
and agreed to by organizational
stakeholders
ISO/IEC 27001:2013 Clause 6.1.3,
Clause 8.3, Clause 9.3
NIST SP 800-53 Rev. 5 PM-4, PM9Supply Chain Risk
Management (ID.SC):
The organization’s priorities,
constraints, risk tolerances, andassumptions are established andused to support risk decisions
associated with managing supply
chain risk. The organization has
established and implemented theprocesses to identify, assess andmanage supply chain risks.

ID.SC-5: Response and recovery
planning and testing are conductedwith suppliers and third-party
providers
ISO/IEC 27001:2013 A.17.1.3
NIST SP 800-53 Rev. 5 CP-2, CP4, IR-3, IR-4, IR-6, IR-8, IR-9260

9Ransomware Application
The ability to receive cyber threat
intelligence from information sharing
sources can reduce the exposure to
ransomware attacks and can facilitate
early detection of new threats.

Understanding the business impacts ofpotential ransomware events is needed
to support cybersecurity cost-benefit
analyses as well to establish priorities
for activities included in ransomware
contingency plans for response andrecovery. Understanding the potential
business impacts also supports
emergency response decisions in theevent of a ransomware attack.
The expense associated with responseto and recovery from ransomware
events is materially affected by theeffectiveness of contingency planningof responses to projected risks.
Establishing and enforcing
organizational policies, roles, andresponsibilities is dependent on
stakeholders agreeing to andmanaging effective risk management
processes. The processes should take
into consideration the risk of aransomware event.
Ransomware contingency planningshould be coordinated with suppliers
and third-party providers, andplanning should include provisions fortesting planned activities. The planshould include a scenario where
suppliers and third-party providers are
impacted by ransomware.

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

Category

Subcategory and Selected
Informative References

Identity Management,
Authentication and AccessControl (PR.AC): Access tophysical and logical assets andassociated facilities is limited toauthorized users, processes, anddevices, and is managed
consistent with the assessed riskof unauthorized access toauthorized activities andtransactions.

PR.AC-1: Identities and credentials
are issued, managed, verified,
revoked, and audited for authorized
devices, users and processes

Ransomware Application

Protect

ISO/IEC 27001:2013 A.9.2.1,
A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6,
A.9.3.1, A.9.4.2, A.9.4.3
NIST SP 800-53 Rev. 5 AC-1, AC2, IA-1, IA-2, IA-3, IA-4, IA-5, IA6, IA-7, IA-8, IA-9, IA-10, IA-11
PR.AC-3: Remote access ismanaged
ISO/IEC 27001:2013 A.6.2.1,
A.6.2.2, A.11.2.6, A.13.1.1,
A.13.2.1
NIST SP 800-53 Rev. 5 AC-1, AC17, AC-19, AC-20, SC-15

PR.AC-4: Access permissions andauthorizations are managed,
incorporating the principles of leastprivilege and separation of duties
ISO/IEC 27001:2013 A.6.1.2,
A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4,
A.9.4.5
NIST SP 800-53 Rev. 5 AC-1, AC2, AC-3, AC-5, AC-6, AC-14, AC16, AC-24

10

Most ransomware attacks are
conducted through network
connections, and ransomware attacks
often start with credential compromise(e.g., unauthorized sharing or captureof login identity and password).
Accordingly, proper credential
management is an essential mitigation,although not the only mitigationneeded.
Most ransomware attacks are
conducted remotely. Management ofprivileges associated with remote
access can help to maintain the
integrity of systems and data files toprotect against insertion of malicious
code and exfiltration of data. Using
token-based multi-factor
authentication will reduce thelikelihood of account compromise.
Many ransomware events occur
through the compromise of user
credentials or by invoking processes
that should not be authorized to haveprivileged access to the process that isbeing infiltrated.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
PR.AC-5: Network integrity isprotected (e.g., network segregation,
network segmentation)
ISO/IEC 27001:2013 A.13.1.1,
A.13.1.3, A.13.2.1, A.14.1.2,
A.14.1.3
NIST SP 800-53 Rev. 5 AC-4, AC10, SC-7

PR.AC-6: Identities are proofed
and bound to credentials andasserted in interactions
ISO/IEC 27001:2013, A.7.1.1,
A.9.2.1
NIST SP 800-53 Rev. 5 AC-1, AC2, AC-3, AC-16, AC-19, AC-24,
IA-1, IA-2, IA-4, IA-5, IA-8, PE-2,
PS-3
Awareness and Training(PR.AT): The organization’s
personnel and partners areprovided cybersecurity awarenesseducation and are trained toperform their cybersecurityrelated duties and responsibilities
consistent with related policies,
procedures, and agreements.
Data Security (PR.DS):
Information and records (data) aremanaged consistent with theorganization’s risk strategy toprotect the confidentiality,

PR.AT-1: All users are informed
and trained
ISO/IEC 27001:2013 A.7.2.2,
A.12.2.1
NIST SP 800-53 Rev. 5 AT-2, PM13

PR.DS-4: Adequate capacity toensure availability is maintained
ISO/IEC 27001:2013 A.12.1.3,
A.17.2.1
NIST SP 800-53 Rev. 5 AU-4, CP2, SC-5

11

Ransomware Application
Network segmentation or segregation
can limit the scope of ransomware
events by preventing malware fromproliferating among potential target
systems (e.g., moving laterally into an
operational technology or control
system from a business information
technology network). It is critical toeffectively separate IT and OT
networks and regularly validate their
independence. This not only reduces
the risk of OT systems being
compromised, but also allows lowlevel critical operations to continue
while business IT system recovers
from ransomware. This is particularly
important for critical ICS functions
including Safety Instrument Systems(SIS).
Compromised credentials are acommon attack vector in ransomware
events. Identities should be proofed
and then bound to a credential (e.g.,
two-factor authentication of formallyauthorized individuals) to limit thelikelihood that credentials arecompromised or issued to an
unauthorized individual.
Most ransomware attacks are madepossible by users who engage inunsafe practices, administrators who
implement insecure configurations, ordevelopers who have insufficient
security training.

Ensuring adequate availability of data
can contribute to further reducing
ransomware impacts.

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

Category

Subcategory and Selected
Informative References

integrity, and availability of
information.

PR.DS-5: Protections against data
leaks are implemented
ISO/IEC 27001:2013 A.12.1.3,
A.17.2.1
NIST SP 800-53 Rev. 5 AU-4, CP2, SC-5
PR.DS-6: Integrity checking
mechanisms are used to verify
software, firmware, and information
integrity
ISO/IEC 27001:2013 A.12.2.1,
A.12.5.1, A.14.1.2, A.14.1.3,
A.14.2.4

Ransomware Application
Double extortion—demanding
payment both to restore data accessand to not sell or publish the data
elsewhere—is very common
nowadays, so data leak prevention
solutions would be useful for facing
current ransomware threats.
Integrity checking mechanisms candetect tampered software updates thatcan be used by criminals to insert
malware that can lead to ransomware
events.

NIST SP 800-53 Rev. 5 SC-16, SI7
PR.DS-7: The development andtesting environment(s) are separate
from the production environment
ISO/IEC 27001:2013 A.12.1.4
NIST SP 800-53 Rev. 5 CM-2
Information Protection
Processes and Procedures(PR.IP): Security policies (thataddress purpose, scope, roles,
responsibilities, management
commitment, and coordination
among organizational entities),
processes, and procedures aremaintained and used to manage
protection of information systems
and assets.

PR.IP-1: A baseline configurationof information technology/industrial
control systems is created andmaintained incorporating security
principles (e.g. concept of least
functionality)
ISO/IEC 27001:2013 A.12.1.2,
A.12.5.1, A.12.6.2, A.14.2.2,
A.14.2.3, A.14.2.4

Keeping development and testing
environments separate fromproduction environments can prevent
ransomware from promulgating fromdevelopment and testing systems into
production systems.
Baselines are useful for establishing
the set of functions a system needs toperform and that any deviation fromthat baseline could be evaluated for its
cyber risk potential. Unauthorizedchanges to the configuration can beused as an indicator of a malicious
attack, which may lead to theintroduction of ransomware.

NIST SP 800-53 Rev. 5 CM-2,
CM-3, CM-4, CM-5, CM-6, CM-7,
CM-9, SA-10
PR.IP-3: Configuration change
control processes are in place
ISO/IEC 27001:2013 A.12.1.2,
A.12.5.1, A.12.6.2, A.14.2.2,
A.14.2.3, A.14.2.4
NIST SP 800-53 Rev. 5 CM-3,
CM-4, SA-10

12Proper configuration change processes
can help to enforce timely security
updates to software, maintainnecessary security configuration
settings, and discourage replacementof code with products that containmalware or don't satisfy accessmanagement policies.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
PR.IP-4: Backups of information
are conducted, maintained, andtestedISO/IEC 27001:2013 A.12.3.1,
A.17.1.2, A.17.1.3, A.18.1.3
NIST SP 800-53 Rev. 5 CP-4, CP6, CP-9

PR.IP-9: Response plans (Incident
Response and Business Continuity)and recovery plans (Incident
Recovery and Disaster Recovery)
are in place and managed
ISO/IEC 27001:2013 A.16.1.1,
A.17.1.1, A.17.1.2, A.17.1.3
NIST SP 800-53 Rev. 5 CP-2, CP7, CP-12, CP-13, IR-7, IR-8, IR-9,
PE-17
PR.IP-10: Response and recovery
plans are tested
ISO/IEC 27001:2013 A.17.1.3
NIST SP 800-53 Rev. 5 CP-4, IR-3,
PM-14

Maintenance (PR.MA):
Maintenance and repairs ofindustrial control and information
system components are performed
consistent with policies andprocedures.

PR.MA-2: Remote maintenance oforganizational assets is approved,
logged, and performed in a mannerthat prevents unauthorized access
ISO/IEC 27001:2013 A.11.2.4,
A.15.1.1, A.15.2.1
NIST SP 800-53 Rev. 5 MA-4

13

Ransomware Application
Regular backups that are maintained
and tested are essential to timely andrelatively painless recovery fromransomware events. Note that backups
should be secured to ensure they can’t
become corrupted by the ransomware
or deleted by the attacker. The
backups should also be stored offline
to prevent ransomware fromencrypting them.
Response and recovery plans should
include ransomware events. A copy of
the response plan should be kept
offline in case the incident eliminatesaccess to soft copies held within thetargeted network. Ransomware eventsshould be prioritized appropriately
during incident triage, and should be
rapidly contained to prevent theransomware’s spread.
Ransomware response and recovery
plans should be tested periodically toensure that risk and response
assumptions and processes are current
with respect to evolving ransomware
threats. Testing of response andrecovery plans should include any
associated ICSes. Note thatorganizations as well as ransomware
evolve. Processes will need to be
updated and maintained to matchchanging organizational needs andstructures as well as new ransomware
types and tactics. Testing trains thepeople who will need to execute theplan.
Remote maintenance provides anaccess channel into networks andtechnology which, if not managed,
criminals may use to alter
configurations in a manner that
permits introduction of malware.
Remote maintenance of all systemcomponents by the organization or its
providers must be validated not toprovide backdoor access to the OT or
IT networks.

NISTIR 8374 (DRAFT)

Category
Protective Technology (PR.PT):
Technical security solutions aremanaged to ensure the security
and resilience of systems andassets, consistent with related
policies, procedures, andagreements.

CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
PR.PT-1: Audit/log records are
determined, documented,
implemented, and reviewed inaccordance with policy

Ransomware Application
Availability of audit/log records can
assist in detecting unexpectedbehaviors and support forensics
response and recovery processes.

ISO/IEC 27001:2013 A.12.4.1,
A.12.4.2, A.12.4.3, A.12.4.4,
A.12.7.1
NIST SP 800-53 Rev. 5 AU-1, AU2, AU-3, AU-4, AU-5, AU-6, AU-7,
AU-8, AU-9, AU-10, AU-12, AU13, AU-14, AU-16
PR.PT-3: The principle of least
functionality is incorporated byconfiguring systems to provide only
essential capabilities
ISO/IEC 27001:2013 A.9.1.2
NIST SP 800-53 Rev. 5 AC-3, CM7

Maintaining the principle of least
functionality may prevent lateral
movement among potential target
systems (e.g., moving into an
operational process control systemfrom an administrative network).

DetectAnomalies and Events(DE.AE): Anomalous activity isdetected and the potential impactof events is understood.

DE.AE-3: Event data are collected
and correlated from multiple
sources and sensors
ISO/IEC 27001:2013 A.12.4.1,
A.16.1.7

Multiple sources and sensors alongwith a Security Information and EventManagement (SIEM) solution would
improve early detection ofransomware.

NIST SP 800-53 Rev. 5 AU-6, CA7, IR-4, IR-5, IR-8, SI-4
DE.AE-4: Impact of events isdetermined
ISO/IEC 27001:2013 A.16.1.4

Determining the impact of events caninform response and recovery
priorities for a ransomware attack.

NIST SP 800-53 Rev. 5 CP-2, IR-4,
RA-3, SI-4
Security Continuous
Monitoring (DE.CM): The
information system and assets aremonitored to identify
cybersecurity events and verify

DE.CM-1: The network ismonitored to detect potential
cybersecurity events
NIST SP 800-53 Rev. 5 AC-2, AU12, CA-7, CM-3, SC-5, SC-7, SI-4

14

Network monitoring might detect
intrusions before malicious code canbe inserted or large volumes of
information are encrypted andexfiltrated.

NISTIR 8374 (DRAFT)

Category
the effectiveness of protective
measures.

CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
DE.CM-3: Personnel activity ismonitored to detect potential
cybersecurity events
ISO/IEC 27001:2013 A.12.4.1,
A.12.4.3

Ransomware Application
Monitoring personnel activity might
detect insider threats or insecure staff
practices or compromised credentials
and thwart potential ransomware
events.

NIST SP 800-53 Rev. 5 AC-2, AU12, AU-13, CA-7, CM-10, CM-11
DE.CM-4: Malicious code is
detected
ISO/IEC 27001:2013 A.12.2.1
NIST SP 800-53 Rev. 5 SI-3, SI-8

DE.CM-7: Monitoring forunauthorized personnel,
connections, devices, and software
is performed

Detection may indicate that aransomware event is occurring or may
be about to occur. Also, malicious
code is often not immediately
executed, so there may be time
between insertion of malicious codeand its activation to detect it before
the ransomware attack is executed.
Monitoring can detect many
ransomware attacks before they are
executed.

ISO/IEC 27001:2013 A.12.4.1,
A.14.2.7, A.15.2.1
NIST SP 800-53 Rev. 5 AU-12,
CA-7, CM-3, CM-8, PE-3, PE-6,
PE-20, SI-4
DE.CM-8: Vulnerability scans are
performed
ISO/IEC 27001:2013 A.12.6.1
NIST SP 800-53 Rev. 5 RA-5
Detection Processes (DE.DP):
Detection processes andprocedures are maintained andtested to ensure awareness ofanomalous events.

DE.DP-1: Roles and responsibilities
for detection are well defined toensure accountability
ISO/IEC 27001:2013 A.6.1.1,
A.7.2.2

Vulnerabilities can be exploitedduring a ransomware attack. Regularscans can allow an organization to
detect and mitigate mostvulnerabilities before they are used to
execute ransomware.
Accountability encourages adherence
to organizational policies andprocedures to help detect ransomware
attacks.

NIST SP 800-53 Rev. 5 CA-2, CA7, PM-14
DE.DP-2: Detection activities
comply with all applicablerequirements
ISO/IEC 27001:2013 A.18.1.4,
A.18.2.2, A.18.2.3
NIST SP 800-53 Rev. 5 AC-25,
CA-2, CA-7, PM-14, SI-4, SR-915

Detection activities should be
conducted in adherence toorganization policy and procedures.
Consistent adherence to organizational
policies and procedures is necessary
for detection activities to be effective
against ransomware attacks.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
DE.DP-3: Detection processes aretestedISO/IEC 27001:2013 A.14.2.8
NIST SP 800-53 Rev. 5 CA-2, CA7, PE-3, PM-14, SI-3, SI-4
DE.DP-4: Event detection
information is communicated
ISO/IEC 27001:2013 A.16.1.2,
A.16.1.3

Ransomware Application
Testing provides assurance of correct
detection processes for ransomwarebased attacks, but not that all intrusion
attempts will be detected.

Timely communication of anomalies
is necessary to remediation before aransomware attack can be launched.

NIST SP 800-53 Rev. 5 AU-6, CA2, CA-7, RA-5, SI-4
DE.DP-5: Detection processes arecontinuously improved
ISO/IEC 27001:2013 A.16.1.6
NIST SP 800-53 Rev. 5 CA-2, CA7, PL-2, PM-14, RA-5, SI-4

The tactics used in ransomware
attacks are continuously being refined,
so detection processes must
continuously evolve to keep up withnew threats.

Respond
Response Planning (RS.RP):
Response processes andprocedures are executed andmaintained, to ensure response todetected cybersecurity incidents.

RS.RP-1: Response plan is
executed during or after an incident

Communications (RS.CO):
Response activities arecoordinated with internal andexternal stakeholders (e.g.
external support from law
enforcement agencies).

RS.CO-1: Personnel know theirroles and order of operations when a
response is needed

ISO/IEC 27001:2013 A.16.1.5
NIST SP 800-53 Rev. 5 CP-2, CP10, IR-4, IR-8

ISO/IEC 27001:2013 A.6.1.1,
A.7.2.2, A.16.1.1
NIST SP 800-53 Rev. 5 CP-2, CP3, IR-3, IR-8

RS.CO-2: Incidents are reported
consistent with established criteria
ISO/IEC 27001:2013 A.6.1.3,
A.16.1.2
NIST SP 800-53 Rev. 5 AU-6, IR6, IR-8

16

Immediate execution of the response
plan’s public relations andcommunications response components
is necessary to stop any corruption orcontinuing exfiltration of data, stem
the spread of an infection to othersystems and networks, and initiate
preemptive messaging.
Response to ransomware events
include both technical and business
responses. An efficient response
requires all parties to understand theirroles and responsibilities.
Communications response roles
should be formally documented inincident response and recovery plans,and should be reinforced by exercising
the plans.
Response to ransomware events
include both technical and business
responses. An efficient response
requires pre-established criteria forreporting and adherence to that criteria
during an event.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
RS.CO-3: Information is sharedconsistent with response plans
ISO/IEC 27001:2013 A.16.1.2,
Clause 7.4, Clause 16.1.2

Ransomware Application
Information sharing priorities include
stemming the spread of an infection toother systems and networks as well as
preemptive messaging.

NIST SP 800-53 Rev. 5 CA-2, CA7, CP-2, IR-4, IR-8, PE-6, RA-5, SI4
RS.CO-4: Coordination withstakeholders occurs consistent withresponse plans
ISO/IEC 27001:2013 Clause 7.4
NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8
RS.CO-5: Voluntary information
sharing occurs with external
stakeholders to achieve broader
cybersecurity situational awareness

Coordination priorities include
stemming the spread of
misinformation as well as preemptive
messaging. Coordination with key
internal and external stakeholders isimportant for stemming the spread of
misinformation and establishingpreemptive messaging.
Information sharing may also yieldforensic benefits and reduce theimpact and profitability ofransomware attacks.

ISO/IEC 27001:2013 A.6.1.4
NIST SP 800-53 Rev. 5 PM-15, SI5
Analysis (RS.AN): Analysis isconducted to ensure effective
response and support recovery
activities.

RS.AN-1: Notifications fromdetection systems are investigated
ISO/IEC 27001:2013 A.12.4.1,
A.12.4.3, A.16.1.5
NIST SP 800-53 Rev. 5 AU-6, CA7, IR-4, IR-5, PE-6, SI-4
RS.AN-2: The impact of theincident is understood
ISO/IEC 27001:2013 A.16.1.4,
A.16.1.6
NIST SP 800-53 Rev. 5 CP-2, IR-4

17

Notifications from detection systems
should be promptly and fully
investigated, as these may often
indicate the early stages of aransomware attack that can therefore
be preempted.
Understanding the impact will shape
the implementation of the recovery
plan. Organizations should seek tounderstand the technical impact of aransomware attack (e.g., what systems
are unavailable) and then understandthe resulting impact on the business(e.g., which business processes can’t
be delivered). This will help to ensurethat the response and recovery effort isproperly prioritized and resourced,
and business continuity plans can be
implemented in the meantime.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
RS.AN-3: Forensics are performed
ISO/IEC 27001:2013 A.16.1.7
NIST SP 800-53 Rev. 5 AU-7, IR-4

RS.AN-5: Processes are established
to receive, analyze and respond tovulnerabilities disclosed to theorganization from internal andexternal sources (e.g. internal
testing, security bulletins, or
security researchers)

Ransomware Application
Forensics help identify the root cause
to contain and eradicate the attack,including things like resetting
passwords of credentials stolen by theattacker, deleting malware used by theattacker, and removing persistencemechanisms used by the attacker.
Forensics can also inform the recovery
process.
Analysis processes can prevent future
successful attacks and the spread of
the ransomware to other systems andnetworks. It can also help restore
confidence among stakeholders.

NIST SP 800-53 Rev. 5 PM-15, SI5
Mitigation (RS.MI): Activities
are performed to prevent
expansion of an event, mitigate its
effects, and resolve the incident.

RS.MI-1: Incidents are contained
ISO/IEC 27001:2013 A.12.2.1,
A.16.1.5
NIST SP 800-53 Rev. 5 IR-4
RS.MI-2: Incidents are mitigated
ISO/IEC 27001:2013 A.12.2.1,
A.16.1.5
NIST SP 800-53 Rev. 5 IR-4

RS.MI-3: Newly identified
vulnerabilities are mitigated or
documented as accepted risks
ISO/IEC 27001:2013 A.12.6.1
NIST SP 800-53 Rev. 5 IR-4

Improvements (RS.IM):
Organizational response activities
are improved by incorporating
lessons learned from current andprevious detection/response
activities.

RS.IM-1: Response plansincorporate lessons learned
ISO/IEC 27001:2013 A.16.1.6,
Clause 10
NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8

18

Immediate action must be taken toprevent the spread of the ransomware
to other systems and networks.
Containment of ransomware includes
any associated ICS.
Immediate action must be taken toisolate the ransomware to minimize
the damage to the data, to prevent the
spread of infection within the networkand to other systems and networks,
and to minimize the impact on the
mission or business.
Vulnerability management isnecessary to minimize the probabilityof successful ransomware attacks. If
vulnerabilities cannot be patched or
mitigated, documenting this risk
allows for its inclusion in future
decision making and provides
transparency for stakeholders thatmight be impacted by ransomware
events.
This is necessary to minimize theprobability of future successful
ransomware attacks and to restore
confidence among stakeholders.

NISTIR 8374 (DRAFT)

CategoryCYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT
Subcategory and Selected
Informative References
RS.IM-2: Response strategies are
updated
ISO/IEC 27001:2013 A.16.1.6,
Clause 10

Ransomware Application
This is necessary to minimize theprobability of future successful
ransomware attacks and to restore
confidence among stakeholders.

NIST SP 800-53 Rev 5 CP-2, IR-4,
IR-8

Recover
Recovery Planning (RC.RP):
Recovery processes andprocedures are executed andmaintained to ensure restorationof systems or assets affected bycybersecurity incidents.

RC.RP-1: Recovery plan is
executed during or after acybersecurity incident

Improvements (RC.IM):
Recovery planning and processes
are improved by incorporating
lessons learned into future
activities.

RC.IM-1: Recovery plansincorporate lessons learned

Immediate initiation of the recovery
plan after the root cause has been
identified can cut losses.

ISO/IEC 27001:2013 A.16.1.5
NIST SP 800-53 Rev. 5 CP-10, IR4, IR-8

ISO/IEC 27001:2013 A.16.1.6,
Clause 10

This is necessary to minimize theprobability of future successful
ransomware attacks and to restore
confidence among stakeholders.

NIST SP 800-53 Rev 5 CP-2, IR-4,
IR-8
RC.IM-2: Recovery strategies are
updated
ISO/IEC 27001:2013 A.16.1.6,
Clause 10

This is needed to maintain theeffectiveness of contingency planningfor future ransomware attacks.

NIST SP 800-53 Rev. 5 CP-2, IR-4,
IR-8
Communications (RC.CO):
Restoration activities arecoordinated with internal andexternal parties (e.g. coordinating
centers, Internet Service
Providers, owners of attacking
systems, victims, other CSIRTs,
and vendors).

RC.CO-1: Public relations aremanaged
ISO/IEC 27001:2013 A.6.1.4,
Clause 7.4
RC.CO-2: Reputation is repaired
after an incident
ISO/IEC 27001:2013 Clause 7.4
RC.CO-3: Recovery activities arecommunicated to internal andexternal stakeholders as well as
executive and management teams
ISO/IEC 27001:2013 Clause 7.4
NIST SP 800-53 Rev. 5 CP-2, IR-4

261
19

This is necessary to minimize thebusiness impact by being open andtransparent and to restore confidence
among stakeholders.
Repair is necessary to minimize thebusiness impact and restore
confidence among stakeholders.
Communication of recovery activity
helps to minimize the business impact
and restore confidence among
stakeholders.

NISTIR 8374 (DRAFT)CYBERSECURITY FRAMEWORK PROFILE FORRANSOMWARE RISK MANAGEMENT

262

References

263
264
265

[1]

National Institute of Standards and Technology (2018) Framework for Improving Critical
Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards andTechnology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018

266
267
268
269

[2]

International Organization for Standardization/International Electrotechnical Commission(ISO/IEC) (2013) ISO/IEC 27001:2013 – Information technology – Security techniques –Information security management systems – Requirements (ISO, Geneva, Switzerland).
Available at https://www.iso.org/isoiec-27001-information-security.html

270
271
272
273

[3]

Joint Task Force (2020) Security and Privacy Controls for Information Systems andOrganizations. (National Institute of Standards and Technology, Gaithersburg, MD),NIST Special Publication (SP) 800-53, Rev. 5. Includes updates as of December 10,
2020. https://doi.org/10.6028/NIST.SP.800-53r5

20