NIST SP 800-61 Rev. 3, published in April 2025, replaces Rev. 2 from 2012. It presents incident response as part of cybersecurity risk management through a CSF 2.0 Community Profile. It is guidance, not a law. AI assistants fit best in supporting tasks, with responders staying in charge.
What the document is
The title is Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. NIST says it helps organizations build incident response recommendations into their cybersecurity risk management activities. The stated goals include preparing for incidents, reducing their number and impact, and improving detection, response and recovery.
It supersedes SP 800-61 Rev. 2, which was published on 6 August 2012. NIST posted a draft on 3 April 2024 before the final.
The main shift
Rev. 2 was a standalone incident handling guide. Rev. 3 is framed as a profile of the NIST Cybersecurity Framework 2.0, which places incident response inside the wider risk program instead of treating it as a separate lifecycle. This page does not list the CSF functions in detail, so read the PDF for the exact mapping rather than relying on a summary.
For your team, the practical meaning is that response, detection and recovery planning should connect to your risk management work and not sit in a binder.
Where AI can help responders
These are our suggestions for supporting work, not statements from NIST.
- Drafting. First drafts of runbooks, timelines and status updates, reviewed by a person. See AI incident summaries.
- Triage support. Summaries and suggested enrichment for incoming alerts. See can an LLM triage security alerts.
- Search help. Drafting queries against logs, which an analyst checks.
- Post incident review. Pulling a timeline from notes and highlighting open questions.
Where to hold back
Do not let an assistant take containment actions without approval. Do not let it decide notification obligations. Do not send sensitive incident data to a model without redaction and a check of provider terms.
Using the document in practice
- Read the Rev. 3 publication page and PDF. Note how it maps to CSF 2.0.
- Compare your current response plan with it and list gaps.
- Pick two gaps and fix them, such as unclear roles or missing practice exercises.
- Record where AI assistance is allowed in your plan and who approves it.
Your plan needs the basics regardless of tools; incident response plan: what to include is a starting point.
Quick check
Is SP 800-61 Rev. 3 mandatory?
It is NIST guidance. Whether it applies to you depends on your contracts and regulators, so check your own obligations.
Does Rev. 3 say anything about AI tools?
This guide did not confirm any AI specific content from the publication page. Check the full PDF before claiming it does.
Sources
Last reviewed: 19 October 2026.
