Skip to main content
Client access Talk to us
Cybersecurity13 min read

NIST SP 800-61r3: incident response no longer fits in an isolated plan

Revision 3 replaced the 2012 guide and structures incident response as a CSF 2.0 Community Profile. Govern, Identify, and Protect prepare; Detect, Respond, and Recover execute — with learning returning to risk management.

Updated
Nature
Operational profile based on NIST SP 800-61r3 and CSF 2.0
Audience
Security, technology, continuity, legal, communications, and leadership
Published and verified
4 August 2026
Limit
Adapt to applicable legal, sector, contractual, and notification requirements
Team moves evidence across six work zones connected to a central incident
Incident response crosses all six CSF 2.0 Functions; it does not begin when the alert arrives.AI-generated image under Velqory editorial direction.

In brief

The practical gain is not renaming phases. It is assigning decisions, evidence, and metrics to all six CSF 2.0 Functions and ensuring that they pass cleanly from one to the next. The board sets appetite and authority; inventory and dependencies determine what to protect first; telemetry creates actionable signals; response contains and communicates; recovery restores by mission priority. The proposed exercise tests an incident through that path and measures four times: detection, decision, containment, and validated recovery.

  • SP 800-61r3 was finalised in April 2025 and supersedes Revision 2.
  • All six CSF 2.0 Functions play roles in incident response; there is no clean boundary between before and during.
  • A playbook should connect every decision to authority, input information, output evidence, and escalation conditions.
  • Recovery is not merely bringing a service online: it validates integrity, mission priority, and residual risk.

Incident response is a six-function risk cycle running at two speeds

Govern, Identify, and Protect operate continuously: they define authority, priorities, assets, dependencies, safeguards, and preparation. Detect, Respond, and Recover accelerate when an event meets the incident criterion. Lessons return to the first group as changes in risk, controls, and investment.

Maintain an operational cadence for restoration and a governance cadence for impact, tolerance, and communication decisions. Combining them creates large meetings without decisions; separating them without an interface leaves executives acting on stale data.

Decision flow across the six Functions

  1. GOVERN
    Set authority and tolerance

    Define who declares, contains, communicates, accepts residual risk, and closes.

  2. IDENTIFY
    Prioritise mission and dependencies

    Connect assets, data, third parties, people, and impact to essential services.

  3. PROTECT
    Prepare safe modes

    Implement safeguards, emergency access, backups, channels, and exercises.

  4. DETECT
    Convert signal into incident

    Preserve source, time, confidence, reach, and declaration criteria.

  5. RESPOND
    Contain and coordinate

    Take reversible decisions, preserve evidence, and communicate on a cadence.

  6. RECOVER
    Restore and validate

    Recover by priority, test integrity, and return lessons to risk.

Documentary basis for this section

The matrix exposes interfaces that narrative playbooks often hide

For each Function, define an observable decision and the evidence passed to the next Function. If the team cannot identify the output artefact, the procedure still depends on conversation and memory.

Function, decision, evidence, and metric

FunctionDecisionOutput evidenceUseful metric
GovernWho may accept and escalate?Authority charter and contactsTime to authorised decision
IdentifyWhich service comes first?Asset–dependency–impact mapCritical-service coverage
ProtectWhich degraded mode is safe?Control, backup, recent testSuccessful test rate
DetectIs this an incident?Signal, context, confidence, timestampSignal-to-declaration time
RespondContain where and with what effect?Decision, action, confirmed stateDeclaration-to-containment time
RecoverCan production resume?Integrity, reconciliation, residual riskTime to validated recovery
Documentary basis for this section

The exercise should cross the organisation and end with a verified change

Use a scenario combining compromised credentials, a failed third party, and potentially altered data. Introduce conflict between rapid recovery and evidence preservation. The team passes when it decides at the right level and can demonstrate the state achieved.

Then select no more than three changes, each with an owner, due date, and test. A long lesson list without verification creates an archive, not resilience.

  • Test alternative channels and a contact directory outside the affected environment.
  • Require technical confirmation of containment effect.
  • Validate data and transactions before declaring recovery.
  • Repeat after remediation and compare all four times.
Documentary basis for this section

Sources consulted

Consulted on the stated update date.

  1. 01NIST SP 800-61 Rev. 3 — Incident ResponseNIST CSRC · CY-NISTCSRC
  2. 02NIST Revises SP 800-61NIST CSRC · CY-NISTCSRC
  3. 03Incident Response project publicationsNIST CSRC · CY-NISTCSRC
  4. 04NIST Cybersecurity Framework 2.0NIST CSRC · CY-NISTCSRC
  5. 05NIST SP 800-184 — Cybersecurity Event RecoveryNIST CSRC · CY-NISTCSRC
  6. 06NIST SP 1299 — CSF 2.0 Resource and Overview GuideNIST CSRC · CY-NISTCSRC
← Back to the Blog