Compliance / NIST SP 800-61
Incident response planning built on NIST SP 800-61.
NIST SP 800-61 is the US government's guidance on cyber incident response. Revision 3, published in April 2025, replaced the 2012 edition and organized incident response around the six functions of the NIST Cybersecurity Framework 2.0.
The change reflects how incidents actually play out. Preparation, detection, response and recovery all depend on governance, asset knowledge and protective controls that were in place long before the first alert. We help you build an incident response program on that model.
At a glance
- Current version
- Revision 3, April 2025
- Structure
- A CSF 2.0 Community Profile
- Replaces
- Revision 2 from 2012 and its four-phase lifecycle
- Related
- The Respond and Recover functions of NIST CSF 2.0
NIST SP 800-61
From a lifecycle to a profile
Revision 2 described a four-phase lifecycle: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Many incident response plans in use today are still built on it.
Revision 3 maps incident response recommendations to CSF 2.0 outcomes instead. Plans written against Revision 2 still work, but updating them gives leadership a clearer link between incident response and the rest of the security program.
How we help
Plans and playbooks
Clear instructions for the worst day of the year.
- Incident response plan aligned with Revision 3
- Playbooks for ransomware, business email compromise and data breaches
- Roles, escalation and decision authority
- Communication and notification procedures
Readiness assessment
Find the gaps before an incident does.
- Assessment against CSF 2.0 outcomes
- Logging and evidence availability review
- Backup and recovery capability review
Exercises
Practice under realistic pressure.
- Tabletop exercises for executives and technical teams
- Technical simulations in RANGE
- After-action reports and improvement tracking
Services that support this work
- Incident Response & Digital ForensicsContain active incidents, find out what happened and recover with evidence you can stand behind.
- Managed Detection & ResponseSecurity monitoring, detection engineering and threat hunting focused on real threats rather than alert volume.
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
FAQ
Frequently asked questions
Do we need to rewrite our incident response plan?
Not necessarily. A plan built on Revision 2 can be updated in place by mapping its procedures to CSF 2.0 outcomes and filling the gaps, usually in governance, communication and recovery.
How often should we test the plan?
At least once a year through a tabletop exercise, and after major changes to your environment, team or threat picture. Regulators, insurers and customers increasingly ask for evidence of testing.
Find out where you stand on NIST SP 800-61.
A readiness review shows what an assessor would find today and what it will take to close the gaps.