NIST SP 800-61 Rev. 3 — Incident Response for Cyber Risk Management
Source: NIST SP 800-61r3 (US Government work, public domain) | Chapters: 6
When to use
Reach for this pack when designing or improving an incident response capability as part of cybersecurity risk management — especially if you are aligning IR to NIST CSF 2.0, migrating from the older SP 800-61r2 life cycle, building a Community Profile for cyber incident risk management, clarifying IR roles and authorities, or tightening coordination, communications, training, and lessons-learned loops.
Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.
How to Use This Skill
- Without arguments — load the core frameworks below.
- With a topic — ask about life-cycle models, CSF Functions in IR, roles, policies/playbooks, preparation profile, detect/respond/recover, or coordination/training.
- With a chapter — ask for
ch01throughch06.
Supporting files: glossary.md, patterns.md, cheatsheet.md.
Core Frameworks & Mental Models
From handling guide to CRM integration
SP 800-61r3 supersedes r2. Tactical how-to content ages too fast for a single static SP, so r3 focuses on integrating IR across CSF 2.0 Functions and points to CPRT, the IR project page, and other resources for implementation depth.
CSF-based IR life cycle
| Layer | Functions | IR role |
|---|---|---|
| Preparation foundation | Govern, Identify, Protect | Prevent, prepare, reduce impact, host many lessons sinks |
| Active IR | Detect, Respond, Recover | Discover, manage, contain, eradicate, restore, communicate |
| Continuous improvement | Identify → Improvement (ID.IM) | Capture lessons anytime; feed all Functions |
Community Profile structure
- Table 2 — Preparation & lessons learned: GV/ID/PR + ID.IM with IR-relative priorities (often lower because not unique to active response).
- Table 3 — Incident response: DE/RS/RC with higher priorities and denser recommendations/considerations.
- Annotations: R recommendation, C consideration, N note; IDs like
DE.CM.R1. Higher-level R/C/N inherit downward.
Roles beyond the IR team
Leadership, handlers (staff/contract/on-demand), technology professionals, legal, public affairs, HR, physical security/facilities, asset owners, and third parties (MSSP, CSP, partners, law enforcement) all participate. Policy must pre-assign disruptive authorities.
Policy and playbooks
Policies cover commitment, scope, definitions, roles/authorities, prioritization/severity, recovery initiation, and measures. Procedures and playbooks make common and emergency paths executable and trainable.
Coordination and learning
Pre-arrange external contacts and sharing rules; train decision-makers as well as handlers; exercise; push findings through ID.IM into detections, safeguards, and governance.
Chapter Index
| # | Section | Key content |
|---|---|---|
| ch01 | Scope Shift and CSF Integration | r3 purpose, supersession of r2, Community Profile mechanics |
| ch02 | IR Life Cycle Model | Legacy vs CSF life cycle, Function roles, Table 1 mapping |
| ch03 | Roles, Policies, Playbooks | Multi-role model, policy elements, procedures/playbooks |
| ch04 | Profile: Preparation & Lessons | Table 2 GV/ID/PR + ID.IM |
| ch05 | Profile: Detect/Respond/Recover | Table 3 DE/RS/RC execution outcomes |
| ch06 | Coordination, Training, Improvement | Comms, sharing, exercises, continuous improvement |
Topic Index
- Active IR layer (DE/RS/RC) → ch02, ch05
- Authorities to shut down / isolate → ch03
- Community Profile priorities (H/M/L) → ch01, ch04, ch05
- Continuous improvement / ID.IM → ch02, ch04, ch06
- Continuous monitoring → ch05
- Coordination with MSSP/CSP/partners → ch03, ch06
- CSF 2.0 Functions in IR → ch02
- Event vs incident definitions → ch01, ch03
- Incident declaration → ch05
- Legal and breach notification context → ch03, ch04
- Lessons learned timing → ch02, ch06
- Life cycle model (legacy r2) → ch02
- Media / public affairs → ch03, ch06
- Playbooks and procedures → ch03
- Policy elements for IR → ch03
- Preparation (GV/ID/PR) → ch02, ch04
- Recovery declaration / backup integrity → ch05
- Roles and responsibilities → ch03
- Supersession of SP 800-61r2 → ch01
- Table 1 phase mapping → ch02
- Threat information sharing → ch05, ch06
- Training and exercises → ch06
Supporting Files
- glossary.md — IR / CSF terms used in 800-61r3
- patterns.md — implementation patterns with When/How/Trade-offs
- cheatsheet.md — decision rules, maps, tells & smells
Scope & Limits
This pack covers NIST SP 800-61 Revision 3 (final 2025-04-03, DOI 10.6028/NIST.SP.800-61r3) — IR as cybersecurity risk management, the CSF-based life cycle, roles/policies, and the Community Profile structure — as synthesized reference notes. Actual page count from extraction metadata is 48. It does not cover: full CSF 2.0 subcategory catalog detail (see nist-csf pack); SP 800-61r2 step-by-step tactical handling as an authoritative current guide; CISA playbooks verbatim; organization-specific legal breach-notification advice; or classified IR programs. US Government public domain work. No source-material download link is published.
