NIST SP 800-61 REV. 3 · CSF 2.0 COMMUNITY PROFILE
Incident response is
risk management.
Trace preparation, detection, response, recovery, and improvement across all six CSF 2.0 Functions. Explore the complete 134-outcome profile and build a local readiness plan.
CSF 2.0 MODEL
Preparation supports response.
Improvement connects everything.
Rev. 3 moves incident response into organization-wide cybersecurity risk management. Govern, Identify, and Protect prepare the organization; Detect, Respond, and Recover execute incident response; Identify–Improvement captures lessons throughout.
REV. 2 → REV. 3
Where the previous phases fit now
COMPLETE COMMUNITY PROFILE
Follow outcomes into action.
Recommendations tell organizations what they should do. Considerations identify options to evaluate. Notes add implementation context.
FUNCTION × PRIORITY
See where incident-response weight falls.
High outcomes are core incident-response activities, Medium outcomes directly support response, and Low outcomes indirectly support it. NIST presents these priorities as a starting point to tailor.
SHARED RESPONSIBILITY
Response is larger than the incident team.
Rev. 3 identifies internal and external participants whose authority, information flows, and coordination should be defined before an incident.
LOCAL READINESS WORKSPACE
Turn profile outcomes into owned work.
Saved only in this browser. No information is uploaded.
READING MODEL
A profile to tailor,
not a checklist to complete.
- 01
Start with the lifecycle
Understand which Functions prepare for incidents, execute response, and drive improvement.
- 02
Explore outcomes
Filter the 134 Function, Category, and Subcategory rows by priority and guidance type.
- 03
Tailor priorities
Use NIST priorities as a starting point, then adjust them for your mission, threats, obligations, and resources.
- 04
Assign evidence
Record owners, implementation status, evidence, and gaps in the browser-local worksheet.
Source and scope
This learning aid reproduces the CSF element descriptions, priorities, recommendations, considerations, and notes in Tables 2 and 3 of NIST SP 800-61 Rev. 3. Interface summaries are teaching aids. This tool is not a compliance certification, does not replace the publication, and should be tailored to organizational needs.
NIST publication page ↗