Rev. 3 changes the publication's scope, lifecycle model, organization, roles, and implementation approach. Use this guide to identify what must be remapped rather than renaming an old Rev. 2 plan.
Published in April 2025, Rev. 3 supersedes the August 2012 Rev. 2 and organizes incident-response recommendations as a CSF 2.0 Community Profile.
Structured answer sets in this page tree.
Cited legal and guidance references.
NIST SP 800-61 Rev. 3 supersedes Rev. 2 and changes how the guidance is used. Rev. 2 was a detailed incident-handling guide built around preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Rev. 3 is a that treats incident response as part of cybersecurity risk management, maps the lifecycle to all six CSF 2.0 Functions, and moves changing procedural detail to online resources.
Rev. 3 shifts the scope from detailed guidance on detecting, analyzing, prioritizing, and handling incidents to recommendations for incorporating incident response throughout cybersecurity risk management. NIST explains that technical procedures change too often and vary too much by technology, environment, and organization to maintain them in one static publication.
The new lifecycle uses all six CSF 2.0 Functions. Govern, Identify, and Protect support preparation and impact reduction. Detect, Respond, and Recover cover discovery, management, prioritization, containment, eradication, recovery, reporting, notification, and other incident communications. Identify Improvement (ID.IM) receives lessons from every Function so useful changes need not wait for recovery to end.
Rev. 3 still provides an incident-response lifecycle, but it does not require every organization to adopt that model. NIST says organizations should use the lifecycle framework or model that suits them best and consider incident response throughout cybersecurity risk management.
Use Rev. 3 for outcomes, priorities, recommendations, roles, and mappings. Use organization-specific procedures and NIST's online Incident Response project, CSF resources, and Cybersecurity and Privacy Reference Tool for implementation detail. A Rev. 2 procedure may still be useful, but its scope, roles, dependencies, and references need review against Rev. 3. NIST sets no separate migration deadline; another law, policy, contract, procurement term, or federal authority may set an implementation date for a particular organization.
Appendix C describes Rev. 3 as a full rewrite that improves clarity and usability, removes outdated material and material covered elsewhere, expands lifecycle, role, policy, process, and procedure content, and adds the Community Profile. Treat migration as a mapping and gap-analysis exercise.
Keep useful Rev. 2 procedures where they still fit the organization, but do not claim that they are the Rev. 3 model. Update references, map responsibilities and outcomes, confirm external dependencies, and identify missing preparation, active-response, recovery, communication, and improvement work.
Retain useful procedures, remap outcomes and roles, replace stale references, and test the revised authority and communication paths.