Which NIST ransomware publications to read first

Start with NIST IR 8374 Rev. 1 for the overall risk picture, then pick by job: SP 1800-25 for protecting data, SP 1800-26 for detecting and responding, SP 1800-11 and SP 800-184 for recovery. NIST lists all of them on its ransomware project page.

The list, grouped

NIST's page organises the material like this:

• Risk management. IR 8374 Rev. 1, the ransomware profile for CSF 2.0, and a Quick Start Guide on getting started with cybersecurity risk management for ransomware.
• Data integrity (SP 1800 series). SP 1800-25 on identifying and protecting assets against ransomware and other destructive events. SP 1800-26 on detecting and responding. SP 1800-11 on recovering.
• Recovery and contingency. SP 800-184, Guide for Cybersecurity Event Recovery, and SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.
• Malware and incident handling. SP 800-83 Rev. 1 on malware incident prevention and handling for desktops and laptops, and SP 800-61 Rev. 2, Computer Security Incident Handling Guide.

Reading order by role

Security lead or CISO

1. IR 8374 Rev. 1 for the structure.
2. The Quick Start Guide for a short orientation.
3. SP 800-184 for how recovery planning fits into risk management.

Infrastructure or backup engineer

1. SP 1800-25 for protection.
2. SP 1800-11 for recovery.
3. SP 800-34 for contingency planning concepts.

Incident manager

1. SP 1800-26 for detection and response.
2. SP 800-61 for the general handling process.
3. SP 800-83 for malware specific handling.

A caution on age

Some of these documents are years old. SP 800-184 is dated December 2016, for example, and the Revision numbers on others indicate earlier editions. Check each publication page for its current status before you base a policy on it. I have not verified the status of every item above beyond what NIST's project page lists.

What NIST says SP 800-184 stresses

Its abstract argues that organisations become more resilient by including recovery planning in risk management, that identifying and prioritising resources guides plans and realistic test scenarios, and that learning from past events helps.

How to keep it manageable

Pick one publication per quarter and turn it into one change: a new test, a revised playbook, a changed backup rule. Reading without a resulting change tends to be forgotten. Keep a short note of what you took from each document and where it applies, so a new team member can follow the trail.

Quick check

Sources

• NIST ransomware project page
• NIST IR 8374 Rev. 1
• NIST SP 800-184

Last reviewed: 19 October 2026.