Use Rev. 3 to design the incident-response program. Use the CISA playbooks to run detailed federal incident and vulnerability procedures when their FCEB scope applies.
The CISA playbooks remain useful outside the federal government as a procedural reference, but their agency coordination steps and federal triggers do not become mandatory for a private organization merely because it adopts them.
Use both when you need an organization-wide incident-response model and an operational procedure. NIST SP 800-61 Rev. 3 is an April 2025 for cybersecurity incident risk management. CISA's 2021 playbooks give Federal Civilian Executive Branch (FCEB) agencies standard procedures for incident and vulnerability response. The playbooks still describe incident phases using Rev. 2, so map their steps to Rev. 3 outcomes instead of treating the documents as the same edition.
NIST SP 800-61 Rev. 3 organizes incident-response recommendations and considerations across all six CSF 2.0 Functions and leaves procedures, timing targets, and lifecycle choice to the adopting organization.
Second framework
CISA playbooks
The CISA incident and vulnerability response playbooks provide concrete operational procedures for Federal Civilian Executive Branch information systems; they are narrower and more prescriptive than Rev. 3.
SP 800-61 Rev. 3 is NIST incident-response guidance for incorporating incident-response recommendations into cybersecurity risk management. Use it to define program scope, owners, evidence, and response practices before mapping operational playbooks.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The two CISA playbooks cover incident response and vulnerability response for FCEB systems, data, and networks. They address agency-CISA communications, coordination between the two response tracks, and common response terminology.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
Use Rev. 3 to set the program model and the applicable CISA playbook to run an FCEB procedure. A non-FCEB organization may adapt the broader practices, but federal-only coordination and reporting steps need an independent legal or contractual basis.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Rev. 3 distributes work across leadership, incident handlers, technology professionals, legal, communications, human resources, physical security, asset owners, providers, and other internal or external parties as the incident requires.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The affected FCEB agency owns its response while coordinating with CISA and, as applicable, other federal, law-enforcement, intelligence, contractor, and service-provider participants. Each playbook separates agency and CISA actions by phase.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
Name the incident commander, vulnerability owner, agency-CISA contact, technical leads, legal and communications contacts, and decision authority. One person may fill several roles, but each decision still needs an accountable owner.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Use Rev. 3 when designing or reviewing the incident-response program, and apply its response outcomes when analyzed adverse events meet defined incident criteria.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The Incident Response Playbook applies to confirmed malicious cyber activity when a major incident has been declared or cannot yet be reasonably ruled out. The Vulnerability Response Playbook addresses urgent and high-priority vulnerabilities actively exploited in the wild; the affected agency, CISA, industry partners, or others may identify them. Specific CISA directives can add mandatory actions and deadlines.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Record the trigger, affected FCEB system or service, current incident severity, vulnerability source, applicable directive, decision owner, and time of each federal notification.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Use NIST SP 800-61 Rev. 3 to organize preparation, detection, response, recovery, communications, and lessons-learned improvements across the incident-response program.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The CISA procedures cover preparation, detection and analysis, containment, eradication, recovery, coordination, communication, closure, and lessons learned for incidents, plus identification, evaluation, remediation, verification, and reporting for vulnerabilities.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Keep one crosswalk from each CISA action to its Rev. 3 outcome, named owner, required input, expected record, and completion criterion. Preserve any CISA-specific approval or communication step rather than hiding it inside a generic NIST task.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Rev. 3 evidence can include declarations, prioritization decisions, investigation and incident data with preserved integrity and provenance, communications, mitigation actions, recovery validation, after-action reports, and improvement records.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA evidence includes incident and vulnerability tracking records, impact and scope assessments, action and decision logs, status reports, notifications, remediation verification, recovery validation, closure material, and lessons learned.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Maintain one evidence index with the source step, owner, timestamp, artifact, approval state, and whether it supports Rev. 3, a CISA playbook, or both. Preserve incident-data integrity and provenance when the same evidence is reused.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Rev. 3 is final guidance published in April 2025 and supersedes Rev. 2. It sets no universal incident clock; define internal timing targets and track any external legal or contractual clock separately.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The playbooks contain phase-specific timing and escalation instructions, but current binding deadlines can also come from an emergency directive, binding operational directive, Office of Management and Budget (OMB) policy, or another federal requirement. The playbook's publication date alone does not establish the current deadline for a specific event.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Maintain separate clocks for internal response targets, playbook steps, CISA directives, OMB reporting, contracts, and law. Confirm the current directive before assigning a deadline, and do not transfer a federal timer to a voluntary user.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Rev. 3 is not a certification or independent penalty regime. Assurance depends on the authority, federal program, policy, contract, customer, or internal governance that incorporates or evaluates it.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
The playbooks implement federal operational procedures under Executive Order 14028 for FCEB information systems. They are not a commercial certification standard. Whether a contractor must follow a step depends on the contract, system responsibility, directive, and agency instructions.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Classify the user as an FCEB agency, a contractor or service provider with a specific obligation, or a voluntary adopter. Record the instrument that makes each step mandatory before presenting it as a duty.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Rev. 3 can supply the outcome structure for CISA procedures, including incident declaration, prioritization, analysis, mitigation, recovery, communication, and improvement.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA records can support Rev. 3 outcomes when they cover the same incident, asset boundary, decision, action, owner, and evidence-quality need. Federal coordination records may have no equivalent in a voluntary NIST program.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Cross-reference shared artifacts instead of duplicating them. Add a bridge note when the edition, system boundary, responsible actor, timing, or approval differs.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Choose Rev. 3 when the need is an organization-wide, CSF 2.0-aligned incident-response risk-management model rather than one federal operational procedure.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Choose the CISA playbooks first for FCEB execution: agency-CISA coordination, phase checklists, reporting thresholds, vulnerability remediation, and federal response records.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
When both apply, use Rev. 3 as the outcome map and the CISA playbook as the procedure. Record where the 2021 playbook's Rev. 2 phase model has been mapped to Rev. 3 rather than claiming a native Rev. 3 alignment.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Scope and covered activity
NIST SP 800-61 Rev. 3
SP 800-61 Rev. 3 is NIST incident-response guidance for incorporating incident-response recommendations into cybersecurity risk management. Use it to define program scope, owners, evidence, and response practices before mapping operational playbooks.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The two CISA playbooks cover incident response and vulnerability response for FCEB systems, data, and networks. They address agency-CISA communications, coordination between the two response tracks, and common response terminology.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
Operational implication
Use Rev. 3 to set the program model and the applicable CISA playbook to run an FCEB procedure. A non-FCEB organization may adapt the broader practices, but federal-only coordination and reporting steps need an independent legal or contractual basis.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Who must act
NIST SP 800-61 Rev. 3
Rev. 3 distributes work across leadership, incident handlers, technology professionals, legal, communications, human resources, physical security, asset owners, providers, and other internal or external parties as the incident requires.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The affected FCEB agency owns its response while coordinating with CISA and, as applicable, other federal, law-enforcement, intelligence, contractor, and service-provider participants. Each playbook separates agency and CISA actions by phase.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
Operational implication
Name the incident commander, vulnerability owner, agency-CISA contact, technical leads, legal and communications contacts, and decision authority. One person may fill several roles, but each decision still needs an accountable owner.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Trigger or threshold
NIST SP 800-61 Rev. 3
Use Rev. 3 when designing or reviewing the incident-response program, and apply its response outcomes when analyzed adverse events meet defined incident criteria.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The Incident Response Playbook applies to confirmed malicious cyber activity when a major incident has been declared or cannot yet be reasonably ruled out. The Vulnerability Response Playbook addresses urgent and high-priority vulnerabilities actively exploited in the wild; the affected agency, CISA, industry partners, or others may identify them. Specific CISA directives can add mandatory actions and deadlines.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Record the trigger, affected FCEB system or service, current incident severity, vulnerability source, applicable directive, decision owner, and time of each federal notification.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Core obligations
NIST SP 800-61 Rev. 3
Use NIST SP 800-61 Rev. 3 to organize preparation, detection, response, recovery, communications, and lessons-learned improvements across the incident-response program.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The CISA procedures cover preparation, detection and analysis, containment, eradication, recovery, coordination, communication, closure, and lessons learned for incidents, plus identification, evaluation, remediation, verification, and reporting for vulnerabilities.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Keep one crosswalk from each CISA action to its Rev. 3 outcome, named owner, required input, expected record, and completion criterion. Preserve any CISA-specific approval or communication step rather than hiding it inside a generic NIST task.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Evidence and records
NIST SP 800-61 Rev. 3
Rev. 3 evidence can include declarations, prioritization decisions, investigation and incident data with preserved integrity and provenance, communications, mitigation actions, recovery validation, after-action reports, and improvement records.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
CISA evidence includes incident and vulnerability tracking records, impact and scope assessments, action and decision logs, status reports, notifications, remediation verification, recovery validation, closure material, and lessons learned.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Maintain one evidence index with the source step, owner, timestamp, artifact, approval state, and whether it supports Rev. 3, a CISA playbook, or both. Preserve incident-data integrity and provenance when the same evidence is reused.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Timing and cadence
NIST SP 800-61 Rev. 3
Rev. 3 is final guidance published in April 2025 and supersedes Rev. 2. It sets no universal incident clock; define internal timing targets and track any external legal or contractual clock separately.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The playbooks contain phase-specific timing and escalation instructions, but current binding deadlines can also come from an emergency directive, binding operational directive, Office of Management and Budget (OMB) policy, or another federal requirement. The playbook's publication date alone does not establish the current deadline for a specific event.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Maintain separate clocks for internal response targets, playbook steps, CISA directives, OMB reporting, contracts, and law. Confirm the current directive before assigning a deadline, and do not transfer a federal timer to a voluntary user.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Enforcement or assurance route
NIST SP 800-61 Rev. 3
Rev. 3 is not a certification or independent penalty regime. Assurance depends on the authority, federal program, policy, contract, customer, or internal governance that incorporates or evaluates it.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
The playbooks implement federal operational procedures under Executive Order 14028 for FCEB information systems. They are not a commercial certification standard. Whether a contractor must follow a step depends on the contract, system responsibility, directive, and agency instructions.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Classify the user as an FCEB agency, a contractor or service provider with a specific obligation, or a voluntary adopter. Record the instrument that makes each step mandatory before presenting it as a duty.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Overlap and reuse
NIST SP 800-61 Rev. 3
Rev. 3 can supply the outcome structure for CISA procedures, including incident declaration, prioritization, analysis, mitigation, recovery, communication, and improvement.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
CISA records can support Rev. 3 outcomes when they cover the same incident, asset boundary, decision, action, owner, and evidence-quality need. Federal coordination records may have no equivalent in a voluntary NIST program.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Operational implication
Cross-reference shared artifacts instead of duplicating them. Add a bridge note when the edition, system boundary, responsible actor, timing, or approval differs.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Practical decision rule
NIST SP 800-61 Rev. 3
Choose Rev. 3 when the need is an organization-wide, CSF 2.0-aligned incident-response risk-management model rather than one federal operational procedure.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
CISA playbooks
Choose the CISA playbooks first for FCEB execution: agency-CISA coordination, phase checklists, reporting thresholds, vulnerability remediation, and federal response records.
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
Operational implication
When both apply, use Rev. 3 as the outcome map and the CISA playbook as the procedure. Record where the 2021 playbook's Rev. 2 phase model has been mapped to Rev. 3 rather than claiming a native Rev. 3 alignment.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
does not prescribe how outcomes should be achieved
Practical decision rule
When should teams use NIST SP 800-61 Rev. 3 first versus CISA playbooks first?
Use NIST SP 800-61 Rev. 3 first when the primary need is to structure NIST outcomes, controls, practices, or response procedures into an owned program.
Use CISA playbooks first when the dominant need is operational incident or vulnerability response procedures, FCEB coordination, remediation tracking, or playbook checklists.
Use both when one set of evidence can support two clearly separated cited claims.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Official CISA playbooks referenced by incident-response programs for federal operational playbook detail.
Incident and Vulnerability Response Playbooks
1
Section 1
When should teams use Rev. 3, the CISA playbooks, or both?
Start with Rev. 3 when you are defining governance, preparation, detection, response, recovery, and improvement across the organization. Start with the CISA Incident Response Playbook when an FCEB agency has confirmed malicious cyber activity and a major incident has been declared or cannot yet be reasonably ruled out. Use the Vulnerability Response Playbook for urgent or high-priority vulnerabilities actively exploited in the wild; it supplements rather than replaces vulnerability management.
Record whether the organization is an FCEB agency, a contractor with a flowed-down requirement, or a voluntary user.
Keep the incident-response record and vulnerability-response record distinct when both playbooks are active.
Map CISA's procedural steps to Rev. 3 outcomes, owners, and evidence; do not relabel a Rev. 2 phase as a Rev. 3 requirement.
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
incident response recommendations and considerations
Supports the NIST side by identifying SP 800-61 Rev. 3 as April 2025 guidance for incident preparation, detection, response, recovery, and lessons learned.
"incident response recommendations and considerations"