NIST SP 800-61 Rev. 3: Incident Response Guidance

What it is

Special Publication 800-61 Revision 3, titled "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile," is NIST's updated guidance on handling cybersecurity incidents, published in April 2025. It supersedes Revision 2 from 2012, which introduced the classic four phase incident response lifecycle (preparation, detection and analysis, containment and eradication and recovery, post-incident activity) that most security courses still teach.

What changed in Revision 3

Rather than keeping incident response as a separate, self contained lifecycle, Revision 3 folds it directly into the NIST Cybersecurity Framework 2.0's functions, Identify, Protect, Detect, Respond, and Recover, treating incident readiness as something that runs continuously through an organisation's broader risk management rather than as a distinct process that switches on only during an incident. This reflects a real shift in how mature security teams operate: incident response quality depends heavily on preparation work (asset inventory, protective controls, detection capability) done long before any incident happens, not just on the response itself.

Why it is worth reading

If you are studying incident response, whether for a SOC analyst role, a certification, or general security literacy, this is the primary source underneath most training material. Courses, vendor whitepapers, and platforms explaining "the incident response process" are almost always simplifying or restating ideas that trace back to this document and its predecessor. Reading it directly avoids picking up a secondhand, sometimes outdated, version of the four phase model that Revision 3 has now moved past.

Free versus paid

Completely free, downloadable as a PDF directly from NIST with no registration, as is standard for NIST Special Publications.

Who it suits

Best read once you already have some grounding in what an incident even looks like, from a platform like LetsDefend or a SOC focused TryHackMe path, since the document assumes familiarity with basic security operations vocabulary rather than teaching it from zero.

Common questions

Is this a hands on tutorial? No, it is a policy and framework level document, not a walkthrough of using a specific tool; hands on practice comes from platforms built for that. Does it replace the old four phase model entirely? It reframes rather than discards the underlying ideas, preparation, detection, containment, recovery, and lessons learned all still matter, but organises them differently around the CSF functions. Is it US government specific? It comes from a US agency but is used as general best practice guidance internationally, much like the framework it maps to.