NIST IR 8374 Rev. 1: the ransomware profile explained

NIST IR 8374 Revision 1 is a Cybersecurity Framework 2.0 community profile for ransomware risk management. It selects the CSF outcomes that help govern, identify, protect against, detect, respond to and recover from ransomware, and can be used to gauge readiness or as a basis for a countermeasure playbook.

What it is

According to NIST's publication page, the document is titled Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile. It was published as a final version in June 2026 and supersedes the original IR 8374 from 23 February 2022. A draft appeared in January 2025. The authors are Murugiah Souppaya, William Barker and William Fisher, with Karen Kent.

How it is organised

The abstract says the profile identifies security outcomes from CSF 2.0 that support governance and the five other functions: identify, protect, detect, respond and recover. The publication page does not list the individual categories, so read the document itself for them.

Practical uses

NIST says the profile can help organisations:

• Gauge their readiness to deal with ransomware threats.
• Gauge their ability to handle the potential consequences.
• Serve as a basis for a ransomware countermeasure playbook.

A simple way to use it

1. Download the profile and list the outcomes for each function.
2. Mark each outcome as in place, partly in place or not started. Be honest.
3. Attach evidence to the ones you mark as in place, such as the backup test record or the exercise report.
4. Rank the gaps by the likelihood that an attacker would use them.
5. Turn the top gaps into work items with owners and dates.
6. Repeat after an exercise or an incident.

Where it fits with other guidance

CISA's guide gives you a checklist, the NCSC gives you a short list of defensive actions, and the NIST profile gives you a structure that maps to a framework many auditors and buyers already recognise. They do not conflict.

Compliance automation note

If you track controls in a compliance tool, a profile like this becomes a mapping exercise. Safeguard's compliance and evidence automation can hold evidence against framework controls, though you still choose which outcomes apply and who owns them.

Common mistakes

• Treating the profile as a checkbox exercise and marking everything done without evidence.
• Ignoring the govern function, where roles, risk appetite and decision rights live.
• Using it once and never revisiting it after an incident or exercise.

The value comes from honest scoring and follow through on the gaps.

Quick check

Sources

• NIST IR 8374 Rev. 1
• NIST ransomware project page

Last reviewed: 19 October 2026.