NIST SP 800-61 Rev. 3, explained

NIST SP 800-61 Rev. 3, titled "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile," was published in April 2025 as a full replacement for the long-standing Computer Security Incident Handling Guide (Rev. 2, August 2012). NIST's own publication record for Rev. 2 states it "was withdrawn on April 3, 2025" and "superseded by SP 800-61 Rev. 3" — this is not a minor refresh sitting alongside the old guide; the 2012 document is formally retired. NIST's abstract for Rev. 3 states its purpose is to help organizations "incorporate cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities as described by the NIST Cybersecurity Framework (CSF) 2.0," aiming to help them "prepare for incident response, reduce the number and impact of incidents that occur, and improve the efficiency and effectiveness of their incident detection, response, and recovery activities."

Why NIST replaced, rather than revised, the 2012 guide

SP 800-61 Rev. 2 organized incident response around its own four-phase lifecycle (Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity), published before the Cybersecurity Framework existed in its current form. By the time NIST CSF 2.0 (see our CSF 2.0 guide) was published in February 2024 with a new GOVERN Function and a reorganized set of Functions, Categories, and Subcategories, incident response guidance that predated CSF risked drifting out of sync with the framework most organizations were already using to structure their broader risk management program. Rev. 3's subtitle — "A CSF 2.0 Community Profile" — signals a deliberate choice to stop maintaining a separate incident-response lifecycle model and instead express incident response recommendations directly in CSF 2.0's own vocabulary.

What a "CSF 2.0 Community Profile" means here

A Community Profile, in NIST's terminology (see our CSF 2.0 guide for Profiles and Tiers generally), is a shared sector- or topic-specific baseline built on top of CSF's structure — a starting Target Profile that a community of organizations can adopt rather than building from scratch. By badging Rev. 3 as a Community Profile rather than a standalone guide, NIST signals that it is meant to be read and applied through CSF 2.0's structure: its keywords include "Cybersecurity Framework" alongside "Incident handling," "Incident management," and "Incident response," and its listed Topics tag is "Cybersecurity framework." Practically, this means a team already running a CSF 2.0 program has a natural place to plug Rev. 3's recommendations in, rather than reconciling two separate taxonomies.

From four phases to six Functions

The clearest structural change is what organizes the document. Rev. 2's four phases are gone as the primary frame; Rev. 3 instead spans NIST CSF 2.0's six Functions — Govern, Identify, Protect, Detect, Respond, Recover (see our CSF 2.0 guide for each Function's definition). Two Functions carry the incident-response-specific Categories directly:

Function	Relevant Categories	What they cover
Respond (RS)	Incident Management (RS.MA), Incident Analysis (RS.AN), Incident Response Reporting and Communication (RS.CO), Incident Mitigation (RS.MI)	Actions taken once an incident is detected
Recover (RC)	Incident Recovery Plan Execution (RC.RP), Incident Recovery Communication (RC.CO)	Restoring assets and operations afterward

But Rev. 3's own framing is broader than just RS and RC: its stated goal is to help organizations "incorporate cybersecurity incident response recommendations and considerations throughout their cybersecurity risk management activities" — meaning Govern (who decides policy and resourcing), Identify (what assets and risks exist to protect), and Protect/Detect (the controls and monitoring that feed into Respond) are treated as part of the same incident-response picture, not a separate upstream concern.

What this means for teams still citing the 2012 guide

Any runbook, vendor SOW, insurance questionnaire, or internal policy that cites "NIST SP 800-61" for its four-phase lifecycle is citing a document NIST itself now lists as withdrawn. That does not mean the underlying practices (preserve evidence, contain before eradicating, document lessons learned) stopped being good advice — but it does mean:

• The authoritative current reference has changed. Citing "NIST SP 800-61" without a revision number now points, by NIST's own numbering, to Rev. 3's CSF-aligned content rather than Rev. 2's phase model.
• Teams built around CSF 2.0 already have a natural home for Rev. 3. If an organization has mapped its program to CSF 2.0's Functions and Categories, Rev. 3's recommendations can be read directly against the RS and RC Categories already in that Profile.
• Teams not yet using CSF 2.0 face a two-step adoption, first getting familiar with the six-Function structure, then applying Rev. 3's incident-specific recommendations within it — rather than adopting Rev. 3 as an island, the way Rev. 2 could be.

Where this sits next to related guidance

Incident response sits downstream of the vulnerability-handling and disclosure processes covered in our CVD process: ISO/IEC 29147 and 30111 guide and the prioritization models in our SSVC guide and KEV + EPSS guide — those help decide which vulnerabilities and signals warrant attention before an incident occurs, while SP 800-61 Rev. 3 covers what happens once a cybersecurity incident is actually underway. For OT-specific incident handling, SP 800-61 Rev. 3's general CSF-aligned recommendations should be read alongside sector-specific guidance such as NIST SP 800-82 (OT security), which this guide does not attempt to summarize.

A workable starting point

1. Stop citing Rev. 2 as current. It is formally withdrawn; update internal policy documents, vendor questionnaires, and training materials to reference Rev. 3 by name.
2. Anchor incident response work in CSF 2.0's RESPOND and RECOVER Categories (RS.MA, RS.AN, RS.CO, RS.MI, RC.RP, RC.CO) rather than reconstructing a separate phase taxonomy, if your organization already tracks CSF 2.0.
3. Treat Govern, Identify, Protect, and Detect as part of incident-response readiness, not a separate program — Rev. 3's own framing explicitly extends incident response considerations into those Functions rather than confining them to RS/RC.
4. Re-map any Rev. 2-era runbook content (the old four-phase checklist) onto Rev. 3's CSF-aligned Categories explicitly, documenting the mapping, rather than assuming the old phase labels still carry NIST's authority unchanged.

SoftWSP's PSIRT support can help build or update an incident response program against the current NIST baseline rather than a withdrawn 2012 guide: see PSIRT services.

This guide summarises public NIST CSRC publication-page metadata for SP 800-61 Rev. 3 (title, abstract, keywords, topics) and the Rev. 2 withdrawal notice; it does not constitute legal or compliance advice. The full Rev. 3 text contains additional detail (e.g., specific recommendation language within each CSF Category) beyond what NIST's publication page summarizes — confirm specific recommendation wording against the full PDF before relying on it operationally.