NIST IR 8374 Rev 1 Ransomware Risk Management Profile Guide: CSF 2.0 Outcomes for Ransomware Defence

Most organisations can list their ransomware controls, but few can show a board, auditor or insurer which outcomes matter most for ransomware and how far they are from achieving them. NIST IR 8374 Rev. 1, "Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile", published as final on 11 June 2026, answers that by selecting the CSF 2.0 outcomes that matter most for ransomware and explaining how each applies. It replaces the February 2022 edition. This guide explains how the profile is built, the outcomes it selects in each CSF function, the identity outcomes that decide most ransomware cases, how to turn it into current and target profiles, what evidence to keep, and how it maps to SP 800-53 and ATT&CK. It is for security leaders, risk owners and GRC teams, and complements the control-level advice in the Ransomware Prevention Guide.

Key takeaways

• It is a community profile, not a control catalogue. The profile picks CSF 2.0 outcomes that matter for ransomware and adds a short "ransomware application" note to each; you choose the controls.
• Rev. 1 is built on CSF 2.0. It now includes the Govern function, covering mission priorities, risk appetite, roles and third-party involvement in incident planning.
• Identity outcomes do much of the work. PR.AA-01, PR.AA-03 and PR.AA-05 cover credentials for users, services and hardware, phishing-resistant MFA and least privilege; NIST notes that credential compromise often starts ransomware attacks.
• Backups have two outcomes. PR.DS-11 requires protected, tested backups with an offline or otherwise protected copy, and RC.RP-03 requires backup integrity to be verified before restoration.
• Use it to build a gap analysis. Score a current organisational profile against a target built from the profile's outcomes, and the gap becomes a funded ransomware roadmap.

What it is and who it applies to

NIST IR 8374 Rev. 1 is a voluntary NIST Interagency Report. It is guidance reflecting good practice, not a legal or regulatory requirement, and it can be used by any organisation of any size or sector. NIST describes it as a way to gauge readiness to counter ransomware, deal with its consequences, and serve as the basis for a ransomware countermeasure playbook. The profile treats ransomware as encryption-based extortion that may also involve data theft.

The 2022 edition was written against CSF version 1.1, which had no Govern function and different subcategory identifiers. Anyone carrying over a 2022 assessment needs to re-map it: identity outcomes moved from the old PR.AC category to PR.AA, platform security outcomes now sit under PR.PS, and governance outcomes such as risk appetite and supplier involvement in incident planning are now explicit. NIST does not publish a line-by-line change list in the document itself, so treat the re-mapping as a fresh assessment rather than a relabelling exercise.

• Executives and boards: use the Govern outcomes and the gap analysis to set risk appetite and decide investment.
• Security and IT teams: use the Protect, Detect, Respond and Recover outcomes to prioritise engineering work.
• Auditors and insurers: the profile gives a recognised, public yardstick for asking about ransomware readiness.
• Small organisations: start with the six-part "Basic Ransomware Tips" in Section 1.2. See the Ransomware Basics for Small Businesses Guide.

Structure and key requirements

The document has an introduction (the ransomware challenge and Basic Ransomware Tips), the profile itself in Table 1, and an appendix of related NIST resources. Table 1 has three columns: CSF 2.0 Category, CSF 2.0 Outcome (the subcategory) and Ransomware Application. There is no separate priority column; NIST says organisations may treat the listed outcomes as priority target outcomes while keeping the full CSF in their risk programme.

Basic Ransomware Tips

1. Plan for ransomware events: priorities, risk appetite, decision-makers and legal obligations (Govern).
2. Educate employees: phishing simulations and a no-blame reporting culture (PR.AT-01).
3. Remove vulnerabilities: patch promptly, segment, use zero trust, allow only authorised applications and set vendor expectations in contracts.
4. Detect and stop quickly: endpoint malware detection, monitoring of directory services, blocking untrusted web resources.
5. Slow the spread: standard accounts with MFA rather than admin accounts, lockout or delays against password guessing, least privilege, immutable storage, external access only through VPN.
6. Improve recovery: exercised response and recovery plans, isolated and tested backups, current contact lists, and consideration of ransomware insurance.

Identity and NHI requirements

The profile's identity outcomes are short, but most ransomware intrusions turn on them: a valid account for initial access, an over-privileged account for spread, and an admin or backup credential to destroy recovery options.

• PR.AA-01 (identities and credentials for users, services and hardware): "services" brings service accounts, API keys and cloud access keys into scope. In the Codefinger S3 Ransomware campaign, a single long-lived AWS key with read and write object permissions was enough to re-encrypt buckets with customer-supplied keys and set lifecycle deletion. Inventory these credentials, give each an owner and replace long-lived keys with short-lived roles. See the Service Account Security Guide.
• PR.AA-03 (authentication): the profile recommends phishing-resistant MFA. The Colonial Pipeline Ransomware Attack began with a dormant VPN account whose leaked password worked because the profile did not require MFA.
• PR.AA-05 (least privilege and separation of duties): remove standing domain admin rights, separate admin accounts from daily accounts, and keep backup administration in a separate identity domain so a compromised directory cannot delete backups.
• DE.CM-03 and DE.AE-02: alert on directory changes, new privileged group members, DCSync-style replication requests (ATT&CK T1003.006) and service accounts logging on to new hosts.
• RS.MI-01 and RS.MI-02: containment includes disabling compromised accounts and revoking tokens and keys, not only isolating hosts. CISA's #StopRansomware Guide advises resetting passwords once the environment is clean, and machine credentials need the same treatment. See the Ransomware Response and Recovery Guide.

Implementation steps

1. Agree scope and owners. Decide whether the profile covers the whole organisation or critical services first, and name an executive owner for each CSF function.
2. Set Govern outcomes first. Document mission priorities, restoration order, risk appetite (including the position on ransom payment and insurance), decision authorities and legal notification duties. See the Ransomware Payments and Sanctions Guide.
3. Build the current organisational profile. For each of the profile's outcomes, record how it is achieved today, the evidence, and a maturity or implementation score (for example, CSF tiers or a 0 to 4 scale).
4. Build the target profile. Use the profile outcomes as the minimum target; raise the target where your threat model or sector demands it.
5. Prioritise the gap. Rank gaps by how directly they break the ransomware chain: phishing-resistant MFA on remote access, privileged account reduction, isolated backups and restore testing usually come first.
6. Map gaps to controls and owners. Translate each outcome gap into SP 800-53 controls or CIS Safeguards and assign delivery dates.
7. Write the playbook. NIST suggests the profile as a basis for a countermeasure playbook; turn Respond and Recover outcomes into concrete steps. The Ransomware Playbook Template is a starting point.
8. Exercise and re-score. Run a tabletop or technical restore test at least annually (ID.IM-04), update the current profile and report the movement.

Decision guidance

• Profile scope: a single organisation-wide profile is simpler to report, but separate profiles for the corporate network, OT and cloud estates expose gaps that an average hides. Large organisations usually need both: one summary for the board and per-estate profiles for engineering.
• Scoring scale: CSF implementation tiers describe the risk programme as a whole and are coarse; a per-outcome 0 to 4 implementation score with evidence links is easier to defend to auditors and shows progress quarter to quarter.
• Small organisations: the six Basic Ransomware Tips, phishing-resistant MFA on email and remote access, an offline backup copy and a one-page response plan cover the highest-value outcomes without a full profile exercise.
• Managed service providers and suppliers: GV.SC-02, GV.SC-08 and DE.CM-06 put third parties inside the profile. Where an MSP holds administrative access, its remote tools and accounts are part of your attack surface; require MFA, logging you can see and inclusion in exercises. See the Managed Service Provider Risk Assessment Guide.
• Insurance and payment: GV.RM-03 places risk transfer, including cyber insurance, inside enterprise risk management, and DE.AE-04 links understanding of impact to ransom decisions. Decide in advance who may authorise engagement with an extortion group and under what legal checks; see the Ransomware Negotiation Guide.
• Authenticity checks: ID.RA-09 asks that hardware and software authenticity and integrity be assessed before acquisition and use, which covers signed updates and trusted sources for remote access and backup software that ransomware groups target.

Evidence and assessment

The profile does not define an assessment procedure, so evidence is whatever demonstrates the outcome. A practical evidence set per outcome group:

Monitor specifically for the precursors CISA lists: misuse of built-in recovery tools such as vssadmin.exe and wbadmin.exe (ATT&CK T1490 Inhibit System Recovery), mass file modification (T1486 Data Encrypted for Impact) and logons through external remote services (T1133) by dormant accounts.

Mapping to other frameworks

NIST publishes CSF 2.0 informative references through the Cybersecurity and Privacy Reference Tool (CPRT) and the Online Informative References (OLIR) catalogue, which the profile points to for mapping data. CISA's #StopRansomware Guide (September 2023, with MS-ISAC, NSA and FBI) is the most useful operational companion: its prevention section is organised by initial access vector and its response checklist covers detection, reporting, containment and recovery.

Common pitfalls

• Scoring outcomes without evidence. A "yes" for PR.DS-11 without a recent restore test record is an assumption, not a profile.
• Ignoring non-human credentials. Teams score PR.AA-01 on human accounts and miss cloud keys and service accounts, which is how campaigns like Codefinger work.
• Backups in the same identity domain. If the backup console trusts the production directory, one domain admin compromise reaches both.
• Govern left to the end. Without agreed restoration priorities and decision authority, incident response stalls on questions the board should have answered in advance.
• Treating the profile as complete. NIST expects the full CSF to remain in the risk programme; the profile is a priority subset.
• Not re-scoring after change. Mergers, cloud migrations and new suppliers alter the current profile; a two-year-old score misleads insurers and boards.

Practitioner checklist

• Download IR 8374 Rev. 1 and confirm your programme references the June 2026 final, not the 2022 edition.
• Document restoration priorities, risk appetite and decision authority for ransomware.
• Score a current organisational profile against every outcome in Table 1, with evidence.
• Set a target profile and rank gaps by how directly they break the ransomware chain.
• Inventory service accounts, cloud keys and API credentials with owners under PR.AA-01.
• Enforce phishing-resistant MFA on remote access, email and administrative interfaces.
• Isolate backups from the production identity domain and test restores with integrity checks.
• Alert on recovery-tool misuse, mass encryption activity and dormant account logons.
• Turn Respond and Recover outcomes into a tested playbook and re-score after each exercise.

Standards and references

• NIST: IR 8374 Rev. 1, Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile
• NIST: Cybersecurity Framework 2.0
• NIST: Ransomware Protection and Response project
• NIST: SP 800-53 Rev. 5
• CISA: #StopRansomware Guide
• MITRE ATT&CK: Data Encrypted for Impact
• MITRE ATT&CK: Inhibit System Recovery

Related NHI Mgmt Group resources: Ransomware Prevention Guide · Ransomware Response and Recovery Guide · Ransomware Playbook Template · Service Account Security Guide