NIST Unveils Brand New SP 800-61 Revision

It has been 13 years since NIST [the US National Institute of Standards and Technology] released a major update to its go-to guide on incident response. The newly revamped SP 800-61 Rev. 3, officially titled ***Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile*, is a ground-up rewrite designed to align tightly with the NIST Cybersecurity Framework (CSF) 2.0.**

As the incident response landscape continues to evolve, it is essential for organisations and institutions to stay informed about these emerging standards and best practices. Understanding these developments is key to maintaining robust security and operational resilience, and that’s exactly what we’ll be exploring within this article.

What Makes Revision 3 So Impactful?

CSF 2.0 Functions at Its Core

SP 800-61 Rev. 3 maps its guidance across all six CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond, and Recover—offering a unified standard that’s already familiar to cybersecurity professionals. This isn’t just academic—they’re betting your incident response will evolve from a siloed function to a fully integrated lifecycle.

An Incident Response Lifecycle Reimagined

The old circular model (detect → analyse → contain → recover → learn) has been replaced by a layered structure:

Foundation – Govern, Identify, Protect (preparation and prevention)
Operational Core – Detect, Respond, Recover (active incident handling)
Continuous Improvement – The Identify/Improvement function is linked to all stages via feedback loops

It’s a setup that acknowledges how incidents now unfold in dynamic, high-stakes environments, and the continuous learning required to stay ahead.

Sharper, More Usable Content

According to NIST, Revision 3 has been fully rewritten for clarity and relevance, removing outdated examples and making the document more actionable.

Wider Roles, Shared Responsibility

Where once “incident response” meant a small, specialised team, now it “encompasses legal, communications, leadership and sometimes external partners,” all sharing responsibility in a collaborative model.

This could include:

Executive leadership and board-level oversight
Internal incident handlers and technical teams
Legal, HR, and public relations
External support via managed service providers or law enforcement

NIST even highlights the importance of clear contracting and accountability when outsourcing parts of the response function.

Cutting Policies, Playbooks & Procedures

Revision 3 provides guidance on updating incident response policies, recommending inclusion of:

Management commitment, scope, and clear definitions
Roles, authority (e.g., who can shut systems down)
Incident triage, categorisation, escalation criteria
Performance metrics and protocols for continual evaluation

But this isn’t just a checklist, it also suggests standard operating procedures and playbooks that can be exercised, refined, and made fit for real-world chaos.

Conclusion

If you’re already employing CSF 2.0 or basing your strategy on earlier versions of SP 800-61, Revision 3 is truly mission-critical. Its updated structure and lifecycle model ensure incident response is embedded across your organisation and not siloed. Furthermore, with evolving threat landscapes, the emphasis on continuous learning and cross-functional collaboration is more than timely, it’s essential.

How AJC Can Help

Wondering how to align with NIST’s new incident response guidance without getting buried in policy rewrites? That’s where we can help. At AJC, we offer practical, hands-on support to help your organisation operationalise the latest best cyber security practices.

What we offer:

Review & Redesign
We assess and refine your existing incident response policies, playbooks, and workflows, mapping them directly to the CSF 2.0 framework. Expect tailored, usable documentation that actually makes sense in a crisis.

Train & Exercise
AJC runs immersive desktop exercises and simulation workshops for your full team, executives, tech staff, legal, HR, and comms. These aren’t checkbox drills; they’re dynamic, stress-tested scenarios that build organisational muscle memory.

Contact us on 020 7101 4861 or email us at info@ajollyconsulting.co.uk if you think we can help.