NIST Ransomware Risk Management Profile

1. Introduction: The NIST Ransomware Risk Management Profile (NISTIR 8374)

Ransomware has evolved from opportunistic malware into a professionalised, extortion-driven criminal ecosystem that now routinely combines data encryption, data exfiltration, distributed denial of service and public shaming (the so-called quadruple-extortion model). In response, the National Institute of Standards and Technology (NIST) published the Ransomware Risk Management: A Cybersecurity Framework Profile, catalogued as NIST Internal/Interagency Report (NISTIR) 8374. First released as a preliminary draft in June 2021 and finalised in February 2022, the document is a purpose-built Profile of the NIST Cybersecurity Framework (CSF) that curates and prioritises the specific CSF outcomes most effective at preventing, detecting, responding to and recovering from ransomware events.

NISTIR 8374 is not a new, free-standing standard with its own control catalogue. It is a lens applied over the CSF. It selects the CSF Subcategories that materially reduce ransomware risk, maps each to authoritative Informative References (NIST SP 800-53 Rev. 5, CIS Controls, ISO/IEC 27001, COBIT, ISA/IEC 62443 and others), and organises them under the five familiar CSF Functions: Identify, Protect, Detect, Respond and Recover. It is deliberately outcome-based and technology-neutral, so that an organisation of any size or sector can adopt it. This guide provides an auditor-grade, implementer-ready walkthrough for CyberSigma clients seeking to assess, uplift and evidence their ransomware resilience against the Profile.

2. What is the NIST Ransomware Risk Management Profile?

The Ransomware Profile is a CSF Profile — a curated alignment of the Framework Core (Functions, Categories and Subcategories) with a specific business objective, in this case managing ransomware risk. NIST calls out a Current Profile (where an organisation stands today) and a Target Profile (the desired ransomware-resilient state). The gap between the two drives a prioritised action plan. NISTIR 8374 supplies a ready-made Target Profile: a filtered set of CSF Subcategories that NIST considers the highest-value defences and recovery capabilities against ransomware.

The Profile pursues two complementary goals. First, help organisations gauge their level of readiness to counter ransomware threats and deal with the potential consequences of an event. Second, help them identify and prioritise opportunities for improving ransomware resilience through a structured, repeatable, CSF-aligned method. It intentionally leans on the CSF because most organisations already know or use the CSF, allowing the Profile to slot into existing governance rather than imposing a parallel regime.

NISTIR 8374 also front-loads a set of concrete, plain-language basic preventative steps — for example, keeping systems patched, using allowlisting, restricting administrative privileges, blocking macros, avoiding personal apps on work devices and continuously training staff. These 'quick wins' are technology-neutral hygiene measures that materially cut ransomware risk before an organisation even begins the deeper CSF Subcategory work.

3. Who must comply / scope of applicability

NISTIR 8374 is voluntary. No statute mandates the Profile by name. However, it is functionally significant because it distils the ransomware-relevant subset of the CSF, and the CSF is referenced or required across many regulatory and contractual regimes. Organisations adopt the Ransomware Profile either directly, or because an overarching obligation (a cyber-insurance questionnaire, a customer contract, a sector regulator, or an executive directive) demands demonstrable ransomware resilience that the Profile conveniently structures.

• Applicability is by risk exposure, not by legal compulsion — any entity that stores, processes or depends on digital assets is in scope.
• The Profile is medium-agnostic: it applies equally to on-premises, cloud, hybrid and operational-technology environments.
• Third parties, managed service providers and outsourced IT are in scope; ransomware frequently enters via the supply chain and MSPs.
• Size scales the depth, not the applicability: micro-businesses focus on the preventative basics; enterprises implement the full Current-to-Target Profile programme.

4. Structure of the Ransomware Profile

The Profile inherits the CSF Core architecture. At the top sit the five Functions. Each Function decomposes into Categories, and each Category into Subcategories — the granular outcome statements that are the true unit of assessment. NISTIR 8374 selects the Subcategories most relevant to ransomware (it does not use every CSF Subcategory) and, for each, lists Informative References that tell an implementer where an authoritative control exists. The table below shows the five Functions, their intent in a ransomware context, and the CSF Category identifiers that fall under each.

5. Master assessment checklist — every Function, Category and ransomware Subcategory

This is the core of the guide. Below, each of the five CSF Functions is broken into its Categories, and for each we enumerate the ransomware-relevant Subcategories selected by NISTIR 8374 with a 'what to verify' and 'typical evidence' pair. Use these tables directly as fieldwork worksheets. No control area is omitted.

5.1 IDENTIFY (ID) — Asset Management & Business Environment

5.2 IDENTIFY (ID) — Governance, Risk Assessment, Risk Strategy & Supply Chain

5.3 PROTECT (PR) — Identity Management & Access Control

5.4 PROTECT (PR) — Awareness & Training and Data Security

5.5 PROTECT (PR) — Information Protection Processes, Maintenance & Protective Technology

5.6 DETECT (DE) — Anomalies & Events, Continuous Monitoring, Detection Processes

5.7 RESPOND (RS) — Response Planning, Communications & Analysis

5.8 RESPOND (RS) — Mitigation & Improvements; RECOVER (RC)

6. Scoping, materiality and tiering

Because NISTIR 8374 is voluntary and outcome-based, scoping is driven by materiality — the potential business impact of a ransomware event on a given asset, service or data set — rather than by a legally fixed boundary. Assessors first identify the crown jewels (systems whose encryption or exfiltration would be existential) and ensure the Protect, Detect and Recover Subcategories are applied to them with the greatest rigour. Lower-materiality assets may adopt the basic preventative steps only.

• Materiality drivers: revenue dependency, safety impact (OT/ICS), regulated data volume, RTO/RPO tightness and single points of failure.
• Crown-jewel scoping: domain controllers, backup infrastructure, ERP/finance systems, PACS/EHR in healthcare, SCADA/ICS in utilities.
• Backup-in-scope rule: backup and recovery infrastructure is always in the highest tier — it is the last line of defence and a prime ransomware target.
• Segmentation for scope reduction: strong network segmentation narrows the blast radius and therefore the high-tier scope.
• Third-party scope: MSP-managed and cloud-hosted assets remain in scope via contractual flow-down and shared-responsibility mapping.

7. Implementation approach (phased)

NIST prescribes a Current-Profile → Target-Profile → action-plan method. CyberSigma delivers this across five phases.

Phase 0 — Preventative basics (weeks 0–2)

• Activities: enforce MFA everywhere, patch internet-facing systems, close exposed RDP, block Office macros from the internet, deploy EDR, verify offline/immutable backups.
• Deliverables: quick-wins report, MFA and EDR coverage baseline, exposed-service closure evidence.

Phase 1 — Scoping and Current Profile (weeks 2–5)

• Activities: asset and data-flow discovery, crown-jewel identification, map current state against the NISTIR 8374 Subcategory set.
• Deliverables: asset/crown-jewel register, Current Profile heat-map by Function, materiality tiering.

Phase 2 — Target Profile and gap analysis (weeks 5–8)

• Activities: set desired maturity per Subcategory, quantify Current-to-Target gaps, prioritise by ransomware risk reduction and effort.
• Deliverables: Target Profile, prioritised gap register, risk-ranked remediation roadmap.

Phase 3 — Remediation and control uplift (months 2–6)

• Activities: implement segmentation, PAM, allowlisting, immutable backups, logging/SIEM, IR and DR plans; remediate patch and configuration gaps.
• Deliverables: hardened baselines, tested backups, approved IR/DR playbooks, closed-gap evidence pack.

Phase 4 — Validation, exercise and continuous improvement (ongoing)

• Activities: ransomware tabletop and full-restore exercises, purple-team/adversary emulation, metrics review, periodic re-profiling.
• Deliverables: exercise after-action reports, restore-time evidence, updated Profile, board resilience report.

8. Maturity / capability tiering model

The CSF Implementation Tiers describe the rigour and integration of an organisation's risk-management practices. NISTIR 8374 uses this tiering to express ransomware-readiness maturity. Tiers are not a strict maturity ladder but express degree of adaptiveness; CyberSigma expresses ransomware readiness across these four tiers.

9. Assessment and audit approach

1. Confirm scope and objectives: agree assets, business units and whether OT/ICS is included; obtain the crown-jewel register.
2. Establish the Target Profile: agree the desired tier per Subcategory with the CISO and risk owners.
3. Collect documentation: policies, IR/DR plans, backup and restore-test logs, MFA/EDR coverage, vulnerability and patch reports.
4. Interview stakeholders: SOC, IT operations, backup admins, IR lead, third-party managers and executive sponsors.
5. Perform technical validation: verify MFA enrolment, backup immutability/air-gap, segmentation, allowlisting, logging and EDR coverage.
6. Test recovery: witness or review a restore test against defined RTO/RPO; validate that backups are isolated from production credentials.
7. Score the Current Profile: rate each Subcategory against the Target and compute per-Function readiness.
8. Identify and rank gaps: map each gap to ransomware kill-chain stage and business impact.
9. Report: deliver an executive summary, Function heat-map, prioritised roadmap and evidence appendix.
10. Re-profile periodically: reassess after remediation and at least annually, or after any significant incident or architecture change.

10. Evidence request list

Requested evidence, grouped by CSF Function, to support a NISTIR 8374 assessment:

• Identify: asset and software inventory, data-flow diagrams, crown-jewel/BIA register, risk assessment, vendor risk assessments and contracts.
• Protect (access): IAM inventory, MFA coverage report, PAM logs, access-review records, remote-access and segmentation design.
• Protect (data & config): encryption configs, hardened-baseline scans, patch/vulnerability reports, allowlisting and macro-blocking policies.
• Protect (backup): backup schedule, 3-2-1/immutable/air-gap architecture, restore-test logs, backup-credential isolation evidence.
• Protect (people): security-awareness curriculum, training completion rates, phishing-simulation metrics.
• Detect: SIEM/EDR/NDR coverage reports, correlation and ransomware-behaviour rules, alert-triage and tuning records.
• Respond: ransomware IR playbook, escalation matrix, regulator/law-enforcement notification templates, tabletop after-action reports.
• Recover: DR runbook, RTO/RPO definitions and achievement logs, communications/PR plan, post-incident review reports.
• Governance: security policy, risk register, board reporting, insurance policy and pre-agreed IR retainer contracts.

11. Roles and responsibilities

12. KPIs and metrics to track

• MFA coverage: percentage of users and privileged accounts on phishing-resistant MFA (target 100% for admins).
• Patch latency: mean time to remediate critical/internet-facing vulnerabilities against SLA.
• Backup restore success rate and measured restore time versus RTO/RPO.
• Percentage of backups that are immutable/air-gapped and isolated from production credentials.
• EDR/anti-malware and logging coverage across endpoints and servers.
• Phishing-simulation click rate and report rate trends.
• Mean time to detect (MTTD) and mean time to respond/contain (MTTR/MTTC) for simulated ransomware.
• Percentage of Subcategories at or above the Target tier (Profile closure rate).
• Number of exposed high-risk services (RDP/SMB) reduced to zero.
• Frequency and pass rate of ransomware tabletop and full-restore exercises.

13. Readiness checklist

• Complete asset and data inventory with crown jewels identified and tiered.
• MFA enforced for all users and phishing-resistant MFA for all administrators.
• Internet-facing RDP and unnecessary services closed; attack surface scanned.
• Immutable and/or air-gapped backups configured, isolated from production credentials.
• Backup restores tested within the last quarter against defined RTO/RPO.
• Office macros from the internet blocked and application allowlisting deployed.
• EDR and centralised logging/SIEM deployed across endpoints and servers.
• Network segmentation isolates crown jewels and backup infrastructure.
• Ransomware-specific IR playbook approved, with escalation and notification templates.
• DR plan tested end-to-end at least annually with lessons captured.
• Security-awareness and phishing-simulation programme running for all staff.
• Threat intelligence and ISAC/ISAO feeds integrated into detection.
• Regulator, law-enforcement and insurer notification paths pre-agreed.
• Third-party/MSP and cloud shared-responsibility resilience requirements confirmed.
• Board-level ransomware risk reporting and risk-appetite statement in place.

14. Common gaps and findings

• Backups exist but are online and reachable with domain-admin credentials — encrypted alongside production.
• Restores never tested; RTO/RPO undocumented, so recovery time is unknown until a real incident.
• MFA missing on legacy VPN, RDP or service accounts — the classic ransomware entry point.
• Flat network with no segmentation, allowing a single foothold to reach the entire estate.
• No application allowlisting and Office macros permitted, enabling initial payload execution.
• Patch backlog on internet-facing systems (VPN gateways, mail servers, hypervisors).
• IR plan exists only for generic incidents, with no ransomware-specific playbook or payment-decision framework.
• Logging gaps and short retention prevent forensic scoping and patient-zero identification.
• No pre-agreed IR retainer, forensic firm, breach counsel or insurer notification path.
• Third-party/MSP access over-privileged and unmonitored; shared-responsibility boundaries unclear.
• Executive and privileged-user awareness training absent; no ransomware tabletop exercises.
• Threat intelligence not operationalised into detection rules for known ransomware TTPs.

15. Ransomware Profile mapped to other frameworks

Because NISTIR 8374 is a CSF Profile, it maps cleanly to the frameworks the CSF already references, and to major regulatory regimes. This helps clients reuse a single evidence set across multiple obligations.

Frequently asked questions

Need help with Ransomware Profile?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.