NIST SP 800-61 Rev. 3

Purpose, scope and authority

Revision 3 aligns incident-response recommendations with CSF 2.0. Govern, Identify and Protect support preparation; Detect, Respond and Recover address incident activities, with improvement feeding back throughout risk management. It is not simply the older revision’s phase model under a new title. Use it to connect response readiness with executive decisions and operational capability. [1]

Principles and operating logic [1]

1. Prepare through governance

Set roles, authority, reporting arrangements and coordination with service providers before an incident. Address the resources and information responders need. Decisions about retention, contracts and access can determine whether an investigation is possible months later.

2. Detect and analyse

Use monitoring and analysis to distinguish relevant adverse events from ordinary noise. Correlate observations, consider impact and scope, and establish criteria for declaring an incident. Record the limitations of available evidence rather than treating silence as proof of safety.

3. Manage the response

Triage and prioritise incidents, coordinate actions and keep decision-makers informed. Assign authority for disruptive containment. A response plan must be usable when key people or systems are unavailable, not only when normal operations continue.

4. Investigate and preserve evidence

Understand what happened and what may still be affected. Preserve the integrity and provenance of investigation data. Maintain records of actions and findings so that recovery decisions, subsequent analysis and applicable reporting can rely on defensible evidence.

5. Contain, eradicate and communicate

Limit harm while addressing the cause and persistence of the incident. Coordinate communications with affected parties and relevant authorities according to actual obligations. Do not announce a complete resolution merely because one malicious file has been removed.

6. Recover and improve

Restore prioritised services, validate restoration and communicate recovery status. Feed lessons into controls, preparation and risk decisions. Improvement should also happen during operations and exercises, rather than waiting exclusively for a final lessons-learned meeting.

Application · editorial recommendations

Our proposed exercise starts with a suspected identity compromise and an unavailable primary messaging service. Ask who declares the incident, who authorises isolation, how the team communicates, which evidence must be preserved and who permits restoration. Give each unresolved decision an owner. Tailor detailed playbooks to actual platforms and dependencies; the publication is not a product-specific command manual.

Evidence for the CISO · proposed review pack

Maintain a response plan, current contacts, escalation criteria, evidence-handling arrangements, exercised playbooks, recovery acceptance criteria and tracked improvements. Measure useful decisions and recovery outcomes alongside elapsed time. A fast ticket closure is not necessarily successful eradication.

Common mistakes and limits

Avoid an isolated SOC-only model, untested supplier assumptions, premature closure and presenting the superseded Rev. 2 as the current reference. The profile prioritises incident-response considerations; consult the complete tables for the individual CSF outcomes and recommendations.

Official sources and reading route

Read these sections in the source: Sections 2–3; CSF 2.0 Community Profile.

1. NIST SP 800-61 Rev. 3 · 2025-04 · supersedes Rev. 2