NIST SP 800-61 Rev. 3 How should teams handle post-incident evidence under NIST SP 800-61 Rev. 3 incident response

Record investigation actions as they occur and safeguard those records because they can contain exploited-vulnerability details, breach information, or information about users. NIST examples of recording methods include a paper logbook, audio or video recordings, and automatic session monitoring and logging, where the incident-response plan and policy permit them. Limit access to authorized personnel.

Separately collect the incident data and metadata needed to establish the sequence, affected assets, magnitude, and root causes. Preserve integrity and provenance from the original source through export, analysis, transfer, and storage. Identify derived items so a reviewer does not mistake a transformed result, screenshot, or analyst note for the source record.

Rev. 3 says formal evidence gathering and chain-of-custody procedures might not be performed for every incident, but it still treats collected incident data as evidence. Decide the handling level from the investigation purpose, possible prosecution or litigation, policy, legal advice, and other applicable requirements. Most routine malware cases may not lead to prosecution, which is NIST's example of why one formal process does not fit every incident.

Apply the organization's evidence-preservation and retention rules. If litigation, prosecution, regulation, contract, insurance, a legal hold, or another authority may affect retention, have the responsible legal or records owner determine the case-specific requirement rather than inventing one from Rev. 3. Record conflicting retention or deletion duties and the approved resolution.

Plan for later access, not only storage. NIST says to consider the cost of retaining the data and the hardware and software needed to access it in the future. Preserve required keys, formats, tools, system versions, and explanatory metadata, or document why continued readability cannot be guaranteed.

The evidence register should identify what was collected, the source asset, collection time and method, collector, storage location, access restrictions, integrity check, provenance, and any known gap. Link each item to the incident analysis, recovery decision, notification assessment, after-action report, or improvement it supports.

Document the retention authority, review or disposition date, responsible owner, and any dependency needed for future access. A legal hold, chain-of-custody record, or special forensic method belongs in the register when another applicable procedure or authority requires it; Rev. 3 does not make those controls universal.

Keep investigation-action records and collected data linked but distinguishable. For an action record, capture who did what, when, under which authority, and with what result. For a collected item, capture source, method, integrity information, provenance, storage, access, and disposition. One record may refer to the other without replacing it.

At closure or disposition review, confirm that required incident documentation is complete, access remains restricted, holds and retention authorities are current, and future-access dependencies still work. Destruction or transfer should follow the approved records process and leave the evidence required by that process.