NIST SP 800-61 Revision 3 was finalized in April 2025 and replaces Revision 2 from August 2012. It is titled as a CSF 2.0 Community Profile, so incident response recommendations now sit inside Cybersecurity Framework 2.0 risk management rather than standing alone as a separate lifecycle document.
What the publication says about itself
According to NIST's publication page, the document helps organizations incorporate incident response recommendations into their cybersecurity risk management activities, as described by CSF 2.0. The stated goals are to help prepare for incidents, reduce their number and impact, and improve the efficiency and effectiveness of detection, response and recovery.
The full title is "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile". The authors are listed as Alexander Nelson, Sanjay Rekhi and Murugiah Souppaya of NIST, with Karen Scarfone of Scarfone Cybersecurity.
What a Community Profile means in practice
A Community Profile in the CSF family maps recommendations to the framework's outcomes, so you can fold them into a profile you already keep. For incident response, that means the work is no longer one phase in a chain that ends with a report. Preparation and improvement are treated as ongoing risk management activity.
This post did not review the full PDF's function by function mapping, so check the document itself before you build a control crosswalk. The NIST page does not list that mapping.
What to do if your plan follows the 2012 guide
You do not need to throw the plan away. Use these steps instead.
- Compare your plan with the new document and note gaps, particularly in preparation and in how lessons feed back into risk decisions.
- Check that your plan references current framework language if auditors or customers ask about CSF alignment.
- Keep the practical parts that already work, such as roles, contact lists and playbooks.
Nothing on the NIST page says Revision 3 is mandatory for private companies. NIST publications are guidance. Treat any contract or regulator that points to it as the authority on how it applies to you.
Why the shift matters
The older model of detect, contain, eradicate and recover assumed a team that only did incident work after an alarm. Modern teams share on-call with engineering, run cloud accounts that fail in new ways and depend on suppliers. Tying response into the same framework used for governance and risk makes it easier to ask for budget and to test the plan on a schedule.
For the content of the plan itself, see what an incident response plan needs on its first page.
Quick check
Is SP 800-61 Rev. 2 withdrawn?
NIST's page states that Revision 3 supersedes Revision 2. Check the NIST site for the current status before citing either in a contract.
Is Rev. 3 a certification standard?
No. It is guidance. There is no certification against it.
Sources
Last reviewed: 19 October 2026.
