NIST SP 800-61 Rev. 3Free Resource

NIST SP 800-61 Rev. 3 Incident response and recovery implementation hub

Use NIST SP 800-61 Rev. 3 to connect preparation and lessons learned with active detection, response, recovery, and incident communications across all six CSF 2.0 Functions. It is intended for most organizations, regardless of sector or size, and for everyone responsible for preparing for, detecting, responding to, or recovering from cybersecurity incidents.

Jump to guides

By Sorena AIApril 2025 NIST finalNo signup required

Quick scan

Implementation guide

How Rev. 3 reframes as cybersecurity risk management.

Playbook template

A scenario-ready structure for triage, mitigation, communication, and recovery.

Severity and SLA model

How to convert NIST risk evaluation factors into prioritization and response timing.

Use one incident model across handlers, asset owners, leadership, technology teams, legal and privacy teams, public affairs, human resources, physical security, providers, and recovery personnel. Define authority, deputies, supplier boundaries, secure communication paths, evidence safeguards, and recovery criteria before an incident.

Key dates

Apr 2025

Published

CSF 2.0

Profile

RS plus RC

Integrated

Evidence

Preserved

What NIST SP 800-61 Rev. 3 helps you do

Run incident response across CSF 2.0

Use Govern, Identify, and Protect to prevent or prepare for incidents and reduce impact. Use Detect, Respond, and Recover to discover, manage, contain, eradicate, and recover from incidents. Feed evaluations and lessons into improvements.

Prioritize and manage incidents by risk

Define risk factors such as asset criticality, functional impact, data impact, stage of observed activity, threat-actor characteristics, and recoverability. Use them to validate reports, estimate severity and urgency, categorize incidents such as ransomware or account takeover, prioritize response, escalate resources or involve higher management, and decide when recovery starts. NIST does not prescribe universal severity bands or response times.

Preserve trustworthy response records

Record investigation actions, collect incident data and metadata, preserve integrity and provenance, restrict access, and follow the organization's retention and evidence-preservation procedures.

Analyze

Communicate

Recover

Publication details

Editorial metadata for this artifact

Author

Sorena AI

Published

Mar 4, 2026

Updated

Jul 24, 2026

NIST published Rev. 3 in April 2025 and superseded the August 2012 Rev. 2. The new edition is a CSF 2.0 : a published baseline of outcomes for a shared incident-response use case that an organization can use as input to its own Target Profile. It is not a universal notification clock, severity scale, certification, or step-by-step playbook. Nongovernmental organizations may use it voluntarily; binding federal authority and applicable laws, regulations, policies, and contracts still control their own duties.

Build an incident-response operating model

Rev. 3 organizes outcomes as cybersecurity risk management rather than a single linear checklist. Follow this path from publication status and lifecycle design to playbooks, evidence, communications, recovery, and external obligations.

Start here: status, scope, and lifecycle

Understand the April 2025 final publication, its replacement of Rev. 2, the voluntary-versus-incorporated distinction, and how all six CSF 2.0 Functions support incident response.

NIST SP 800-61 Rev. 3: What Changed from Rev. 2

See how NIST SP 800-61 Rev. 3 replaced Rev. 2's incident-handling guide with a CSF 2.0 Community Profile and what teams should update.

Read guide

NIST SP 800-61 Rev. 3 CSF 2.0 Incident Profile Guide

Map NIST SP 800-61 Rev. 3 across CSF 2.0 preparation, Detect-Respond-Recover operations, and continuous improvement without treating the profile as a law or playbook.

Read guide

Using NIST SP 800-61 Rev. 3 for Incident Response

Use NIST SP 800-61 Rev. 3 to assign incident-response outcomes, owners, records, communications, and improvements while tracking binding duties separately.

Read guide

Prepare and operate

Turn the profile into scenario playbooks, organization-defined risk criteria, escalation authority, third-party coordination, and recovery decisions.

NIST SP 800-61 Rev. 3 Incident Response Playbook Template

Build a scenario-specific incident playbook with declaration criteria, authority, third-party coordination, response evidence, legal overlays, and recovery exit criteria.

Read guide

NIST SP 800-61 Rev. 3 Incident Severity and Response Targets

Build organization-defined incident severity bands and response targets from NIST risk factors without claiming that NIST prescribes levels or deadlines.

Read guide

NIST SP 800-61 Rev. 3 Incident Communications and Escalation

Separate incident coordination, notification, public communication, information sharing, escalation, and elevation, with owners and decision records.

Read guide

NIST SP 800-61 Rev. 3: escalation decision workflow for incident communications

Run incident coordination, required notifications, public updates, and voluntary information sharing as separate, documented decision streams.

Read guide

Evidence and continuous improvement

Preserve investigation records and incident data with integrity and provenance, complete recovery documentation, and route lessons through Identify Improvement.

NIST SP 800-61 Rev. 3 Post-Incident Evidence Log Workflow

Preserve incident records and data, document recovery, produce the after-action report, and verify corrective actions under NIST SP 800-61 Rev. 3.

Read guide

Compare and apply

Keep NIST guidance distinct from operational playbooks, continuity and incident-management standards, and binding notification regimes.

NIST SP 800-61 Rev. 3 vs CISA playbooks: practical side-by-side comparison

Choose NIST SP 800-61 Rev. 3 for an organization-wide incident-response risk model and CISA's playbooks for detailed FCEB incident and vulnerability procedures.

Read guide

NIST SP 800-61 Rev. 3 vs ISO 22301 business continuity: practical side-by-side comparison

Use NIST SP 800-61 Rev. 3 for cybersecurity incident response and ISO 22301:2019 with Amendment 1:2024 for the business continuity management system.

Read guide

NIST SP 800-61 Rev. 3 vs ISO/IEC 27035: practical side-by-side comparison

Compare NIST SP 800-61 Rev. 3's CSF 2.0 outcome profile with the ISO/IEC 27035 incident-management process, planning, and ICT response guidance.

Read guide

NIST SP 800-61 Rev. 3 vs NIS2 incident reporting: practical side-by-side comparison

Use NIST SP 800-61 Rev. 3 to run incident response and the applicable NIS2 national law to assess significant-incident reporting and legal deadlines.

Read guide

NIST SP 800-61 Rev. 3 FAQ: practical implementation questions

Answers on incident declaration, severity, roles, communications, notification clocks, evidence, recovery, and continuous improvement under NIST SP 800-61 Rev. 3.

Read guide

Next step

Map Rev. 3 outcomes to owners and evidence

Turn the selected Rev. 3 outcomes into assigned work, evidence requests, decision records, and review points.

What this unlocks

Scope the work by service, asset, team, provider, or incident scenario.
Assign each outcome, decision, evidence request, and review point to an owner.
Keep policies, procedures, incident records, and recovery evidence linked to the relevant outcome.
Review gaps after exercises and incidents and track the resulting improvements.

Recommended route

Open Assessment Autopilot

Create owned tasks, evidence requests, and review checkpoints for selected Rev. 3 outcomes.

Supporting route

Open SSOT

Keep documents, evidence, and control records in one governed system from the same artifact.

Talk to Sorena

Talk through implementation

Review your incident-response process, evidence model, recovery criteria, and next implementation steps.

Discuss your setup