Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Ransomware Risk Management: Draft NISTIR 8374 Available for Comment

The public comment period for Draft NISTIR 8374, "Ransomware Risk Management," is open through October 8, 2021

Businessman hand holding money banknote for paying the key from hacker for unlock folder got ransomware malware virus computer. Vector illustration technology data privacy and security concept.
Credit: Shutterstock/Nicescene

The National Cybersecurity Center of Excellence (NCCoE) has released a revised draft report, NIST Interagency or Internal Report (NISTIR) 8374, Cybersecurity Framework Profile for Ransomware Risk Management, for public comment. This revised draft addresses the public comments provided for the preliminary draft released in June 2021.

Ransomware is a type of malware that encrypts an organization’s data and demands payment as a condition of restoring access to that data. In some instances, ransomware may also steal an organization’s information and demand additional payment in return for not disclosing the information to authorities, competitors, or the public. Ransomware attacks target organizations’ data or critical infrastructure, disrupting or halting operations. 

This report defines a Ransomware Profile, which identifies security objectives from the NIST Cybersecurity Framework that support preventing, responding to, and recovering from ransomware events. The profile can be used as a guide to managing the risk of ransomware events. That includes helping gauge an organization’s level of readiness to mitigate ransomware threats and to react to the potential impact of events.

The public comment period is open through October 8, 2021. See the publication details for a copy of the draft and instructions for submitting comments. You can also contact us at ransomware [at] (ransomware[at]nist[dot]gov).

NOTE: A call for patent claims is included on page iii of this draft.  For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.

Released September 8, 2021, Updated September 23, 2021