NIST SP 800-61 Revision 3: what changed and what to update
The four-phase incident response lifecycle is no longer NIST’s model. If your IR plan opens with that circle (Preparation, Detection & Analysis, Containment Eradication & Recovery, Post-Incident Activity), it is citing SP 800-61 Revision 2, which was superseded in April 2025.
Before you rewrite anything: the phases are not wrong, and you are not required to drop them. What NIST superseded is a document. What changed is which model NIST presents as its own.
Why NIST changed it
The circle was drawn for 2012. Incidents were rarer then, narrower in scope, and usually resolved within a day or two. A separate team handled them, finished, wrote the review, and fed improvements back into preparation. The loop closed neatly because incidents did.
None of that holds now. NIST’s own account is that incidents occur frequently and cause far more damage, and that recovery often takes weeks or months. It adds that lessons learned should often be shared as soon as they are identified, rather than held until after recovery concludes.
What replaced the four phases
Revision 3 is called “Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile.” The subtitle carries the change. It is no longer a handling manual. It maps incident response onto the six Functions of the Cybersecurity Framework 2.0. You can read the publication itself on the NIST site.
NIST gives a plain reason. The details of how to perform incident response change so often, and vary so much across technologies, environments and organizations, that it is no longer feasible to keep them in a single static publication. So the six Functions, each written as an outcome rather than a task:
- Govern: risk management strategy, expectations and policy are established, communicated and monitored
- Identify: current cybersecurity risks are understood
- Protect: safeguards for those risks are in use
- Detect: possible attacks and compromises are found and analyzed
- Respond: action is taken on a detected incident
- Recover: affected assets and operations are restored
Calling it a Community Profile has a practical upside. Every Function, Category and Subcategory carries an identifier, and NIST’s Cybersecurity and Privacy Reference Tool maps those to other standards and guidance. One example NIST gives is associating CSF 2.0 outcomes with the SP 800-53 controls that can help achieve them. Your IR plan can share a vocabulary with the rest of your compliance work.
The model is three levels, not a circle
Revision 3 stacks the six Functions into three levels, and the stacking is the argument. The middle level is not a seventh Function: it is the Improvement Category (ID.IM) that sits inside Identify.
Two things moved. Preparation left incident response proper, because Govern, Identify and Protect are much broader risk management activities that also support it. And improvement stopped being the final step: lessons from every Function feed into Improvement, where they are analyzed, prioritized and used to inform all six.
Revision 2 described a team that responded to incidents. Revision 3 describes an organization that never stops preparing for them.
Translate your existing plan in four lines
Revision 3 ships a mapping table so you do not start from a blank page. Note that the phases do not map one-to-one: Improvement appears against three of the four rows, because lessons are meant to be captured throughout.
Nothing you do during an incident changed. Containment is still containment. It just sits under Respond and Recover now instead of owning a slice of the circle.
Practice this with IR Now
Expert-informed, scenario-based training tailored to your organization.
Request accessWhat to update this quarter
- Fix every citation pointing at Revision 2 or the four-phase figure
- Add a Govern section naming who can disconnect or rebuild production
- Widen your roles list past incident handlers to legal, comms, HR and asset owners
- Write down what your MSSP, cloud providers and ISPs are contractually on the hook for
- Turn your longest procedures into playbooks with steps someone can follow at 2am
- Open a standing improvement channel that accepts lessons mid-incident
Training moved inside the framework
Improvement has a subcategory for improvements identified from security tests and exercises, including those done with suppliers and relevant third parties. NIST’s note on it does two jobs at once: such exercises may provide helpful information for program evaluation, and they prepare staff and involved third parties for future incident response activities. The same activity is both the measurement and the preparation.
A neighbouring subcategory asks you to evaluate program performance periodically, through self-assessments, third-party assessments or audits. For running the exercises themselves, Revision 3 hands off to SP 800-84. So “we trained the team” is no longer a footnote. It sits in the loop that drives your other changes.
Where IR Now fits in
Revision 3 names the outcomes and leaves the method open. Two of those outcomes are people knowing their role before an incident, and exercises that produce evidence you can evaluate. Our IR plan starter guide covers the sections a plan needs, and the cost of being unprepared covers what skipping them runs you. That is the gap between a written plan and a prepared team.
IR Now builds scenario training from your own systems and compliance frameworks, adds role-specific modules on Pro, and records who completed what and when. That record is what makes an exercise an Improvement input instead of a calendar event nobody can account for later.
Key takeaways
- Revision 2 was superseded in April 2025, so update your citations
- Revision 3 is a CSF 2.0 Community Profile, not a handling manual
- Preparation sits outside incident response now, while Detect, Respond and Recover are the response
- Improvement runs continuously instead of waiting for the post-incident review
- Keep the four phases if they suit your team, because NIST explicitly allows it
- Exercises and training are named Improvement inputs, so the training record counts
