NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile

Why it Matters

Incidents now occur frequently, cause far more damage than they did in 2012, and often take weeks or months to recover from. NIST SP 800-61 Rev. 3 responds by treating incident response as a continuous part of cybersecurity risk management and by giving every organization a common CSF 2.0 vocabulary for planning, running, and improving it.

Key benefits include:

• Integrate incident response with risk management

Preparation, detection, response, recovery, and lessons learned sit inside the same governance and risk activities the rest of the security program already uses.

• Speak a shared vocabulary

Every recommendation is tied to a CSF 2.0 Function, Category, and Subcategory, so incident response can be discussed with executives, auditors, insurers, and regulators in terms they already know.

• Reflect modern incidents

The life cycle model assumes long, complex incidents and continuous improvement instead of a closed loop that restarts after each event.

• Clarify roles and responsibilities

Section 2 sets out the internal teams, leadership, and third parties that carry incident response duties across all six Functions.

• Stay current without reissuing the document

Playbooks, technical guidance, and mappings to other standards are maintained online through the NIST Cybersecurity and Privacy Reference Tool.

How it Works

NIST SP 800-61 Rev. 3 is a 48-page publication in three parts. Section 1 introduces the document and its purpose, Section 2 explains incident response as part of cybersecurity risk management, including the new CSF 2.0-based life cycle model, roles and responsibilities, and incident response policies, processes, and procedures, and Section 3 presents the CSF 2.0 Community Profile itself in two tables: part 1, Preparation and Lessons Learned, and part 2, Incident Response. References, a glossary, and a change log from Revision 2 complete the document.

Implementation starts by comparing the organization's existing incident response plan and playbooks with the Profile's Subcategories and recording where each is met, partially met, or missing. Teams then assign owners for each Function, align detection sources, escalation paths, containment and eradication steps, and recovery criteria with the Detect, Respond, and Recover outcomes, define reporting and notification obligations, and schedule exercises and post-incident reviews so that lessons learned reach the Improvement Category and change the program.

Within SmartSuite, teams hold the Community Profile as a structured control library, link each Subcategory to the incident response plan sections, playbooks, and detection sources that satisfy it, and record incidents, timelines, decisions, and evidence in one place. Exercises, post-incident reviews, and remediation tasks run on assigned owners and due dates, and dashboards show the state of preparation and response outcomes for leadership and auditors.

Key Elements

• CSF 2.0-based life cycle model

Replaces the Rev. 2 cycle of preparation, detection and analysis, containment, eradication and recovery, and post-incident activity with a model built on the six CSF 2.0 Functions.

• Preparation through Govern, Identify, and Protect

Broader risk management activities that prevent some incidents, prepare the organization for those that occur, and reduce their impact.

• Incident response through Detect, Respond, and Recover

Outcomes for discovering, prioritizing, containing, eradicating, and recovering from incidents, and for reporting, notification, and other communications.

• Continuous improvement

The Improvement Category (ID.IM) receives lessons learned from every Function as they are identified, not only after recovery ends.

• Roles and responsibilities

Guidance on the individuals, teams, leadership, and third parties that hold incident response duties inside and outside the organization.

• Policies, processes, and procedures

Considerations for the incident response policy, plan, and procedures that set authority, scope, and workflow.

• Community Profile tables and online resources

Two tables list recommendations and considerations per Subcategory, and the CPRT links each to implementation guidance and mappings to other standards.

Framework Scope

NIST SP 800-61 Rev. 3 applies to any organization that must prepare for and handle cybersecurity incidents, from federal agencies, for which NIST guidance carries FISMA weight, to private companies, critical infrastructure operators, and small businesses. It covers incident response governance, preparation, detection, response, recovery, communication, and improvement, and it deliberately leaves detailed technical procedures and playbooks to the online resources it references.

Framework Objectives

The publication aims to help organizations prepare for incidents, reduce how many occur and how much harm they cause, and improve the efficiency and effectiveness of detection, response, and recovery.

Integrate incident response into cybersecurity risk management across the organization rather than isolating it in one team.

Organize incident response recommendations and considerations as a CSF 2.0 Community Profile with a shared taxonomy.

Provide a life cycle model that reflects long, complex modern incidents and the need for continuous improvement.

Clarify the roles and responsibilities of internal teams, leadership, and third parties in incident response.

Support incident reporting, notification, and communication obligations to regulators, partners, and the public.

Connect organizations to current online implementation resources and cross-standard mappings through the CPRT.

Framework in Context

NIST SP 800-61 Rev. 3 is the incident response companion to NIST CSF 2.0 and draws its structure from it. It supports the Incident Response (IR) control family in NIST SP 800-53 Rev. 5 and the authorization and monitoring steps of the Risk Management Framework in NIST SP 800-37 Rev. 2, and it uses the risk vocabulary of NIST SP 800-30 Rev. 1. Internationally it sits alongside ISO/IEC 27035 and the incident management controls 5.24 to 5.28 of ISO/IEC 27002:2022, while CIS Control 17 and the SOC 2 CC7 criteria are commonly mapped to it.

Common Framework Mappings

NIST SP 800-61 Rev. 3 is commonly mapped to other control frameworks and standards so that one incident response program can evidence several obligations at once, and the NIST CPRT publishes reference mappings for the Profile.

Mapped frameworks include:

NIST CSF 2.0

NIST 800-53 Rev.5

NIST 800-37 Rev.2

NIST SP 800-30 Rev. 1

ISO 27001:2022

ISO 27002:2022

ISO/IEC 27035

CIS Controls v8.1

SOC 2 (AICPA TSC 2017)

NIST CSF v1.1