The NIST incident response lifecycle has evolved over time. In the latest guidance from NIST Special Publication (SP) 800-61 Revision 3 (published in 2025), it is integrated with the NIST Cybersecurity Framework (CSF) 2.0 to emphasize a continuous, risk-management-oriented approach rather than a strictly linear process.
This contrasts with the previous Revision 2 model, which outlined four discrete phases:
- Preparation;
- Detection and Analysis; Containment,
- Eradication, and Recovery;
- Post-Incident Activity.
Incident Response Recommendations and Considerations for Cybersecurity Risk Management
The updated model maps activities across CSF 2.0’s six core functions (Govern, Identify, Protect, Detect, Respond, and Recover), with a focus on preparation, core response, and continuous improvement. Below is an explanation of the key phases in this current framework, including their mappings and primary activities.
1. Preparation (Mapped to Govern, Identify, and Protect Functions)This foundational phase encompasses broader cybersecurity risk management activities to prevent incidents, prepare for effective handling, and minimize potential impacts. It is not limited to incident response but supports it by building resilience and readiness. Key elements include:
- Govern (GV): Establishing policies, strategies, and oversight for managing cybersecurity risks (e.g., defining roles, responsibilities, and incident response policies).
- Identify (ID): Conducting risk assessments, asset inventories, and vulnerability management to understand the organization’s environment (e.g., identifying critical assets and potential threats).
- Protect (PR): Implementing safeguards like access controls, data security measures, awareness training, and resilience planning (e.g., backups and secure configurations to aid future recovery).
This phase maps to the “Preparation” phase from the previous model and emphasizes proactive measures to reduce incident likelihood and severity.
2. Detection (Mapped to Detect Function)The detection phase focuses on identifying potential cybersecurity incidents through monitoring and analysis. It enables early discovery to limit damage. Key activities include:
- Continuous monitoring of networks, systems, and endpoints for anomalies (e.g., using tools like SIEM or SOAR systems).
- Analyzing adverse events with cyber threat intelligence (CTI) to characterize them, determine scope, and declare an incident if warranted.
This aligns with the “Detection and Analysis” phase from the prior model and is considered a high-priority core activity in incident response.
nvlpubs.nist.gov
3. Response (Mapped to Respond Function)Once an incident is detected, this phase involves taking immediate actions to manage, analyze, mitigate, and communicate about it. It is divided into sub-categories for structured handling:
- Incident Management: Triaging, prioritizing, and escalating incidents based on severity.
- Incident Analysis: Investigating root causes, collecting forensic evidence, and assessing impacts.
- Mitigation: Containing the incident (e.g., isolating affected systems) and eradicating threats (e.g., removing malware).
- Reporting and Communication: Notifying internal stakeholders, external partners, regulators, or affected parties as required.
This phase corresponds to the “Containment, Eradication, and Recovery” phase from the earlier model (specifically the containment and eradication parts) and is a high-priority component to limit ongoing harm.
nvlpubs.nist.gov
4. Recovery (Mapped to Recover Function)The recovery phase aims to restore affected systems, data, and operations to normal while verifying integrity and monitoring for reoccurrence. Key activities include:
- Executing recovery plans, such as restoring from backups and validating system functionality.
- Communicating recovery progress and status updates to stakeholders.
This also ties into the “Containment, Eradication, and Recovery” phase from the previous model (focusing on the recovery aspect) and ensures business continuity post-incident.
5. Improvement (Mapped to Identify – Improvement Category)This ongoing phase involves evaluating incidents, exercises, and operations to identify lessons learned and integrate them back into all other functions for enhancement. It creates feedback loops for continuous improvement, such as:
- Conducting post-incident reviews, tests, and evaluations.
- Updating policies, plans, training, and tools based on findings.
It maps to the “Post-Incident Activity” phase from the old model and applies across the entire lifecycle, ensuring adaptability to emerging threats.
Overall, the NIST model promotes a holistic, iterative process with feedback loops, prioritizing high-impact activities like detection, response, and recovery while integrating preparation and improvement. Organizations are encouraged to tailor this framework to their size, risks, and resources, often using a community profile for implementation guidance.
