FAQGLOBALNIST SP 800-61 Rev. 3

NIST SP 800-61 Rev. 3 How should teams handle post-incident evidence under NIST SP 800-61 Rev. 3 incident response

A standalone answer for teams deciding how post-incident evidence should be collected, retained, protected, and reviewed under NIST SP 800-61 Rev. 3.

Each answer is standalone, including the decision context, owner mapping, evidence gate, and next-step trigger so users can apply it in one pass.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Short answer: treat post-incident evidence as collected incident data and metadata that must be preserved with integrity and provenance. NIST SP 800-61 Rev. 3 says to collect and retain evidence from an incident in accordance with the organization’s evidence preservation procedures and data retention policies, and to consider the possibility of prosecution and the cost of keeping the data and the hardware and software needed to access it later.

Search this module

Find a question or answer quickly

2 of 2 questions

Question 1

How should teams handle post-incident evidence under NIST SP 800-61 Rev. 3 incident response?

Collect the incident data and metadata that explain what happened, which systems were involved, and what actions were taken. NIST SP 800-61 Rev. 3 notes that formal evidence gathering and chain-of-custody handling may not be needed for every incident, but the collected data is still evidence and its integrity and provenance should be preserved.

Use your evidence preservation procedures and data retention policies to decide what to keep, how to store it, and who can access it. Keep evidence long enough to support follow-up analysis, recovery, or possible legal action, and account for the cost of retaining the data and the hardware and software needed to read it in the future.

Collect incident data and metadata that support analysis, recovery, and documentation.
Preserve the integrity and provenance of records and evidence.
Follow evidence preservation procedures and data retention policies when deciding what to retain.
Consider whether the incident may lead to prosecution or other legal action.
Weigh the cost of keeping the data, plus the hardware and software needed to access it later.

Citations

NIST SP 800-61 Rev. 3 Incident Response

Primary NIST final publication page for SP 800-61 Rev. 3.

NIST SP 800-61 Rev. 3 DOI

DOI for the April 2025 incident response publication.

NIST CSF 2.0 (CSWP 29)

Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.

Recommended next step

Put this NIST SP 800-61 Rev. 3 guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

Assessment workflow

Open Assessment Autopilot for NIST SP 800-61 Rev. 3

Create source-linked tasks, evidence requests, and review checkpoints for this NIST SP 800-61 Rev. 3 scope.

Explore next step

Talk to Sorena

Review this NIST SP 800-61 Rev. 3 scope with Sorena

Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.

Explore next step

Question 2

What evidence should support post-incident evidence under NIST SP 800-61 Rev. 3?

Keep the supporting record simple and practical: write what happened, what was collected, where it is stored, who owns it, and when it should be reviewed or disposed of. If you cannot show that the evidence came from a controlled process, the record is harder to trust.

A useful evidence package should show the current state and the basis for it, not just a generic statement that evidence exists. That means documenting the decision, linking to the source evidence, and noting any gaps, accepted risk, or dependencies that affect retention or future access.