NIST Revises SP 800-61: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
April 03, 2025

Incident response is a critical part of cybersecurity risk management and should be integrated across organizational operations. The six Functions of the NIST Cybersecurity Framework (CSF) 2.0 all play vital roles in incident response.

NIST has finalized Special Publication (SP) 800-61r3 (Revision 3), Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, which describes how to incorporate incident response recommendations into cybersecurity risk management activities in alignment with CSF 2.0. This guidance will help organizations reduce the number and impact of incidents that occur and improve the efficiency and effectiveness of their incident detection, response, and recovery activities.

SP 800-61r3 supersedes SP 800-61r2 (Revision 2), Computer Security Incident Handling Guide.

Readers of SP 800-61r3 are encouraged to utilize the resources on NIST’s Incident Response project page in conjunction with this document to implement these recommendations and considerations