Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Ransomware Risk Management: A Cybersecurity Framework Profile

Published

Author(s)

Bill Fisher, Murugiah Souppaya, William C. Barker, Karen Scarfone

Abstract

Ransomware is a type of malicious attack where attackers encrypt an organization's data and demand payment to restore access. In some instances, attackers may also steal an organization's information and demand an additional payment in return for not disclosing the information to authorities, competitors, or the public. This Ransomware Profile identifies the Cybersecurity Framework Version 1.1 security objectives that support preventing, responding to, and recovering from ransomware events. The profile can be used as a guide to managing the risk of ransomware events. That includes helping to gauge an organization's level of readiness to counter ransomware threats and to deal with the potential consequences of events.
Citation
NIST Interagency/Internal Report (NISTIR) - 8374
Report Number
8374

Keywords

Cybersecurity Framework, detect, identify, protect, ransomware, recover, respond, risk, security.

Citation

Fisher, B. , Souppaya, M. , Barker, W. and Scarfone, K. (2022), Ransomware Risk Management: A Cybersecurity Framework Profile, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.8374, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=934219 (Accessed August 8, 2022)
Created February 23, 2022