Key concepts
Revision 3 replaces the older stand-alone incident handling life cycle of Revision 2 with a CSF 2.0 Community Profile. It lists the outcomes that help an organization prepare for incidents, reduce how often they happen and how much damage they do, and detect, respond and recover more efficiently. Implementation details are kept in online resources so they can be updated.
- Preparation is most of incident response: roles, policies, contacts and practice happen before an incident
- The old phases (prepare, detect and analyze, contain, eradicate, recover, lessons learned) map onto CSF functions
- Communication and reporting are outcomes to plan, not afterthoughts
How it is organized
- Introduction
- Incident response as part of cybersecurity risk management (mapping the old life cycle to CSF 2.0)
- The CSF 2.0 Community Profile for incident response: preparation (Govern, Identify, Protect) and handling (Detect, Respond, Recover)
- Appendices: acronyms, glossary, change log
What a school district should take from it
- An incident response plan is a leadership document as much as a technical one: it names decision makers and authority.
- Arrange outside help (incident responders, legal counsel, insurer hotline) before you need it.
- Plans that are never exercised fail at the first unexpected step.
How to use it in your district
- Build your incident response plan around the CSF Respond and Recover functions, with Govern outcomes for roles and authority.
- Name the incident lead, the decision maker for shutting systems down, and the communications lead.
- Pre-arrange outside help: insurer or pool hotline, incident response firm, legal counsel, and state reporting contacts.
- Run a tabletop exercise at least once a year and turn findings into Improvement plan items.
- Keep an offline copy of the plan and contact list.
Common misconceptions
- Revision 3 removed the incident response life cycle.
- The familiar phases are still recognizable; they are mapped onto CSF 2.0 functions.
- Incident response belongs to the technology department.
- It needs leadership decisions, communications, legal and business office roles.
- A plan template is enough.
- A plan only works when people know their roles and have practiced them.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- RS.MAIncident Management
- RS.ANIncident Analysis
- RS.COIncident Response Reporting and Communication
- RS.MIIncident Mitigation
- RC.RPIncident Recovery Plan Execution
- RC.COIncident Recovery Communication
- GV.RRRoles, Responsibilities, and Authorities
Tools in the program portal
- Tabletop exercisesRun a scenario and capture after-action improvements
- Incident DeskDeclare an incident and track reporting clocks
- Incident respondersLine up outside response help before you need it
- Cyber insurancePolicy conditions, questionnaire and Breach Day card
- Guide: Ransomware tabletop checklist for a school dayPublic guide
Related publications
- IR 8374 Rev. 1Ransomware risk management profile
- SP 800-184Recovering from a cyber event
- SP 800-34 Rev. 1Contingency planning
Citation and source
SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile. National Institute of Standards and Technology. 2025. https://doi.org/10.6028/NIST.SP.800-61r3.
Replaces: SP 800-61 Rev. 2 (2012).
Topics: Incident response, Frameworks and profiles. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.