What Is NIST SP 800-61?
Definition
NIST SP 800-61 is the U.S. National Institute of Standards and Technology's guide to handling cybersecurity incidents, and the source of the best-known incident response lifecycle. Revision 3, published in April 2025, replaced Revision 2 (2012) and reorganized the guidance around the six Functions of the NIST Cybersecurity Framework (CSF) 2.0.
How It Works
The classic lifecycle (Revision 2). The 2012 edition described four phases:
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery
- Post-Incident Activity, which feeds lessons back into Preparation
The current model (Revision 3). NIST now maps incident response to CSF 2.0. Govern, Identify, and Protect are preparation: broader risk management that also supports incident response. Detect, Respond, and Recover are the incident response itself. Improvement, a category within Identify, sits in the middle and takes lessons from every Function. Table 1 of Revision 3 maps the old phases to the new Functions:
| Revision 2 phase | CSF 2.0 Functions in Revision 3 |
|---|---|
| Preparation | Govern, Identify (all categories), Protect |
| Detection and Analysis | Detect, Identify (Improvement category) |
| Containment, Eradication, and Recovery | Respond, Recover, Identify (Improvement category) |
| Post-Incident Activity | Identify (Improvement category) |
Why NIST changed it. Revision 3 explains that when the old cycle was drawn, incidents were relatively rare, narrow, and usually handled within a day or two. Today they are frequent, more damaging, and recovery often takes weeks or months, so incident response has to be part of ongoing risk management, with lessons shared as soon as they are found. Revision 3 also dropped most step-by-step technical detail, which NIST says changes too fast for a static document, and points readers to CSF 2.0 resources instead.
Real-World Example
CISA's #StopRansomware Guide, published with the Multi-State Information Sharing and Analysis Center, is a good example of the lifecycle in action. Its Part 2 response checklist is organized in the same order as the classic model: Detection and Analysis; Reporting and Notification; Containment and Eradication; and Recovery and Post Incident Activity. It tells victims to move through the first three steps in sequence and to follow their approved incident response plan. A small business that writes its plan in these terms can hand it to an IT provider, insurer, or federal responder and be understood immediately.
Why It Matters for a Small Business
SP 800-61 is free and vendor-neutral, and NIST says it provides "a common language that all organizations can use" to talk about incident response plans inside and outside the company. Using it means your plan lines up with what outside responders, insurers, and auditors expect, and with the CSF 2.0 framework itself. Revision 3 is written as a CSF 2.0 Community Profile, so each recommendation links to CSF outcomes and, through NIST's online reference tool, to related standards. You do not need a security team to use it: the outcomes scale down to a one-page plan that names who decides, who to call, and where the backups are.
The practical caution: Revision 2 was withdrawn on April 3, 2025. Its four phases are still a fine way to organize a checklist, but a plan that cites only Revision 2 is out of date.
How to Spot It / How DTS Handles It
Signs your plan needs work: it does not name a decision-maker, it has no phone numbers for your insurer, bank, or IT provider, it has never been tested in a tabletop exercise, or it still cites only the 2012 guide.
DTS writes and updates small business incident response plans in the language of SP 800-61 Revision 3 and CSF 2.0, and runs the response when a plan is put to the test. See our incident response service.
Related Terms
- Incident response: the overall process this guide describes.
- NIST Cybersecurity Framework (CSF 2.0): the framework Revision 3 is organized around.
- Containment: one of the classic lifecycle stages.
- Eradication: removing the attacker, inside the Respond Function.
- Recovery: the Recover Function in practice.
- Post-incident review: the lessons-learned step, now the Improvement category.
- Tabletop exercise: the cheapest way to test a plan built on SP 800-61.
Sources
- NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025): https://csrc.nist.gov/pubs/sp/800/61/r3/final
- NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (August 2012; withdrawn April 3, 2025): https://csrc.nist.gov/pubs/sp/800/61/r2/final
- NIST, Cybersecurity Framework (CSF 2.0): https://www.nist.gov/cyberframework
- CISA and MS-ISAC, #StopRansomware Guide (Part 2, Ransomware and Data Extortion Response Checklist): https://www.cisa.gov/stopransomware/ransomware-guide
Last updated October 14, 2026.