NIST SP 800-61 Rev. 3: what changed from Rev. 2

NIST SP 800-61 Rev. 3 was finalised in April 2025 and supersedes Rev. 2 from August 2012. Its title is "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile". The shift is from a standalone handling guide to incident response built into overall risk management.

The basics

According to NIST's publication page, the final version is dated 3 April 2025 and was written by Alexander Nelson, Sanjay Rekhi and Murugiah Souppaya of NIST and Karen Scarfone of Scarfone Cybersecurity. It supersedes SP 800-61 Rev. 2, dated 6 August 2012.

The abstract says the publication helps organisations incorporate incident response guidance into their cybersecurity risk management activities, so they can prepare for incident responses, reduce the number and impact of incidents, and improve detection, response and recovery.

What "Community Profile" means

Rev. 3 applies the NIST Cybersecurity Framework 2.0 to incident response. A Community Profile maps a shared set of outcomes onto the framework so that many organisations can adopt it as a starting point.

I could not retrieve the full text of the document in preparing this post, so check NIST's PDF for how it organises the outcomes under the CSF 2.0 functions before quoting the structure.

Why this matters in practice

The framing in the title and abstract is incident response as part of cybersecurity risk management, expressed in CSF 2.0 terms. I did not retrieve the full text to compare the two revisions section by section, so read both before describing specific structural differences.

Practical consequences for a policy owner:

1. Treat response as part of risk management. Your incident plan should connect to your risk register and your risk appetite. See writing a risk appetite statement.
2. Reference the current document. Policies and customer questionnaires that cite SP 800-61 Rev. 2 should be updated to Rev. 3.
3. Keep your existing plan. Nothing in Rev. 3 makes a sensible plan obsolete. SP 800-53 IR-4 still describes handling in terms of preparation, detection and analysis, containment, eradication and recovery.
4. Map once. If you report against CSF 2.0, the profile helps you show incident response coverage in the same language.

Who is bound by it

NIST publications are guidance. US federal agencies have specific obligations that cite NIST standards, but a private company is not bound by SP 800-61 unless a contract or regulation points to it. Customers sometimes ask for alignment as a courtesy, so be accurate: say "aligned with" only if you have mapped your practice, and never "certified".

What to do this quarter

• Read the NIST page and PDF for the exact structure.
• Update the references in your incident response plan and policy.
• Compare your plan to the profile and note gaps. A spreadsheet is enough.
• Add the review to your plan maintenance schedule.

For plan content, see what goes in an incident response plan.

Safeguard's compliance and evidence automation can help track which controls and documents you have mapped to a framework.

Quick check

Sources

• SP 800-61 Rev. 3, NIST CSRC publication page
• IR-4 Incident Handling, NIST SP 800-53 Rev. 5

Last reviewed: 19 October 2026.