NIST SP 800-61 Rev 3: Incident Response Guide (2026)

What changed from Rev 2 to Rev 3

Rev 2 described incident response as a four-phase life cycle: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Rev 3 does not keep that model as its main structure. Instead, it treats incident response as part of cybersecurity risk management and organises the recommendations around the six functions of NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The Rev 2 model is shown only for reference, and NIST says organisations should use the life cycle model that suits them best.

Rev 3 is also written for a wider audience. It is intended for most organisations, regardless of sector or size. Federal agencies are covered by the legal authorities NIST cites, but private-sector organisations can adopt it voluntarily.

How the old phases map to CSF 2.0

Rev 3 includes its own mapping of the Rev 2 phases to the CSF 2.0 functions. In summary:

The practical lesson is that most of the work happens before an incident. Govern, Identify and Protect cover preparation and lessons learned. Detect, Respond and Recover cover the incident itself. Rev 3 expresses its recommendations as a CSF 2.0 community profile, with a priority (high, medium or low) for each item.

What your IR programme should be able to show

An assessor will not ask whether you have read SP 800-61. They will ask for evidence. A useful minimum set is:

• Governance: an approved IR policy, named roles and responsibilities, and an owner for each playbook.
• Preparation: an asset and data inventory that tells responders what matters most, plus tested contact lists for legal, privacy, communications and management.
• Detection: the log sources and alerts that feed your triage process, with records of how alerts were reviewed.
• Response: incident records that show timestamps, decisions, approvals and containment steps.
• Recovery: restoration tests, and records that show when normal service resumed.
• Improvement: post-incident reviews with tracked actions, not only meeting notes.

IR checklist for audit readiness

1. The IR policy is approved, dated and reviewed on a schedule.
2. Roles are named, including a decision-maker who can authorise containment.
3. Playbooks exist for your most likely incident types, such as ransomware, account compromise and data leakage.
4. At least one exercise was run in the last 12 months, with a written outcome.
5. Alerts, tickets and incident records can be exported with timestamps.
6. External reporting duties are documented (see the NIS2 note below).
7. Every post-incident review produces actions with owners and due dates.

Mapping to SP 800-53 Rev 5 incident response controls

If you are assessed against SP 800-53 Rev 5, the Incident Response (IR) family is where these activities appear as controls. The active controls are IR-1 Policy and Procedures, IR-2 Incident Response Training, IR-3 Incident Response Testing, IR-4 Incident Handling, IR-5 Incident Monitoring, IR-6 Incident Reporting, IR-7 Incident Response Assistance, IR-8 Incident Response Plan and IR-9 Information Spillage Response. SP 800-61 gives guidance on how to run the process. SP 800-53 gives the control statements an assessor tests. They complement each other. For a deeper view of the control family, see our guide to NIST 800-53 IR incident response controls.

Illustrative example: ransomware on a file server

The timeline below is an example of how a programme might use the structure. It is not a NIST requirement, and your own times and decision gates will differ.

• Detect: An alert flags mass file renaming on a file server. The analyst opens an incident record and confirms the activity within the agreed triage time.
• Respond: The incident lead isolates the host, preserves logs and memory evidence, and informs legal and management. The decision to isolate and the time it was taken are recorded.
• Recover: The team restores from a clean backup, checks integrity, and monitors the system closely before returning it to service.
• Improve: The team reviews what allowed the compromise, updates the playbook, and tracks each fix to completion.

Notice that every step produces a record. That record is what an assessor reads.

Where regulation adds deadlines

SP 800-61 is guidance, not a reporting law. If you operate in the EU, the NIS2 Directive adds notification duties for in-scope entities, including an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report afterwards. Check the Directive and your national law for the exact rules that apply to you. Our NIS2 compliance checklist covers this in more detail.

How CyberSilo helps

Good incident response depends on evidence you can retrieve quickly. ThreatHawk SIEM centralises logs and alerts so your team can show what was detected, when and by whom. To see how this connects to other frameworks, visit our NIST compliance hub and our guide to the NIST CSF Respond function. If you are drafting your plan, start with our NIST incident response plan template.

Frequently asked questions

Is SP 800-61 Rev 3 final?

Yes. NIST published it as a final document in April 2025, and it supersedes Revision 2.

Does Rev 3 replace the four-phase model?

Rev 3 is organised around the six CSF 2.0 functions instead. The Rev 2 life cycle appears only for reference, and NIST says organisations may use whichever model suits them.

Is SP 800-61 mandatory for private companies?

No. NIST says nongovernmental organisations may use it voluntarily. Contracts, regulators or customers may still ask you to follow it.

How does SP 800-61 relate to SP 800-53?

SP 800-61 gives guidance for building and running incident response. SP 800-53 contains the IR control family that assessors test.

What evidence shows that an IR plan has been tested?

A written exercise report, the scenario used, the decisions made, the gaps found, and tracked actions that were closed.

Does SP 800-61 set NIS2 reporting deadlines?

No. The deadlines come from the NIS2 Directive and national law. SP 800-61 helps you build the process that can meet them.

Sources: NIST SP 800-61r3 (CSRC) · NIST Revises SP 800-61 (news)