NIST SP 800-61 Revision 3, finalized in April 2025, replaces the 2012 Revision 2. It is now titled as a CSF 2.0 Community Profile, which means incident response is treated as part of overall cybersecurity risk management rather than a separate lifecycle you start when something breaks.
The basic facts
The final version appeared in April 2025, with a draft posted in April 2024. It supersedes SP 800-61 Rev. 2, dated 6 August 2012. The full title is Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile.
NIST states the aims as helping organizations prepare for incidents, reduce how many occur and how much damage they cause, and make detection, response and recovery more efficient and effective.
What a community profile means
A community profile applies the NIST Cybersecurity Framework 2.0 to a particular topic, here incident response. Instead of presenting a standalone process, it maps response practices onto the CSF's risk management activities.
In practical terms, that connects incident response to governance, identification of assets and risks, protection, detection, response and recovery as one program. Readers who know the older four phase lifecycle in Rev. 2 should expect a different organizing structure. Read the document itself for the exact mapping, because this post summarizes only the publication's abstract.
Why SOC and response teams should care
Response is not only the SOC's job. A profile tied to CSF 2.0 pushes planning, preparation and lessons learned into the same conversation as risk and asset management. For a SOC, that suggests three habits:
- Feed what you learn from incidents back into detection, logging and asset records.
- Agree roles before an incident, including who decides on containment.
- Measure preparation as well as response speed.
What to do now
- If your plan cites Rev. 2, note that it has been superseded and plan an update.
- Read the new document with your response plan open beside it.
- List differences in terminology and structure, and decide which to adopt.
- Check whether your auditors or customers cite a specific revision.
What this post does not claim
No law makes this publication mandatory for private companies. Some contracts and programs reference NIST guidance, so check your own obligations. Details of individual recommendations are in the publication, not here.
Updating your own plan
Take your current plan and sort its sections under the six CSF 2.0 functions: govern, identify, protect, detect, respond and recover. Gaps usually appear under govern and identify, such as who owns incident decisions and which assets matter most. That sorting exercise is cheap and tells you where the new framing changes your work.
Also check training and exercises. A plan that has never been rehearsed is a draft. Schedule a tabletop that uses the updated structure.
Quick check
Is Rev. 2 withdrawn?
NIST lists Rev. 3 as superseding Rev. 2. Check the publication page for current status before citing either.
Is it only for federal agencies?
It is general guidance. Anyone can use it, and it is often used as a reference outside government.
Sources
Last reviewed: 19 October 2026.
