NIST Incident Response Plan Template (800-61 Rev 3 / CSF Aligned)

IR Plan Template — Table of Contents

1. Purpose, scope, and severity definitions
2. Roles, on-call, and escalation (including executives and legal)
3. Preparation and enabling controls (Govern / Identify / Protect linkages)
4. Detection and analysis procedures (Detect)
5. Containment, eradication, recovery (Respond / Recover)
6. Communications and regulatory notifications
7. Evidence handling and forensics
8. Lessons learned and improvement (ID.IM)
9. Tabletop and exercise schedule

How CyberSilo Helps

• ThreatHawk SIEM and Agentic SOC AI — Detect and Respond operations
• Compliance Standards Automation — IR plan and exercise evidence mapped to CSF and 800-53 IR

Frequently Asked Questions

Can we still use the four-phase IR lifecycle?

Yes, as an internal model. Map phases to CSF Functions so the plan stays compatible with SP 800-61 Rev 3 and CSF Profiles.

How often should we tabletop?

At least annually is common practice; increase cadence after major changes, incidents, or customer/contract requirements.

Does this replace 800-53 IR controls?

No. The plan is an operational artefact that helps demonstrate IR-family outcomes when those controls are selected.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · 800-61 Guide