Earlier in April, the U.S. National Institute of Standards and Technology (“NIST”) published Special Publication (“SP”) 800-61, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, Revision 3 (“NIST SP 800-61”).  NIST SP 800-61 Revision 3 (“Revision 3”) is a significant change, as it not only represents the first update of the document since 2012, but also now maps the document’s recommendations and considerations for incident response to the six functions outlined in the recently-updated NIST Cybersecurity Framework 2.0—Govern, Identify, Protect, Detect, Respond, and Recover.  As a result, Revision 3 includes significant new recommendations and guidance for incident response, and entities should consider reviewing and updating their incident response plans and procedures to incorporate these recommendations, particularly if an entity has aligned its cybersecurity program with the NIST Cybersecurity Framework or used the prior versions of NIST SP 800-61 as a basis for existing incident response plans or procedures.

NIST SP 800-61, which was first published in 2008 and last updated in 2012, is designed to assist organizations with cybersecurity incident response and cybersecurity risk management.  In Revision 3, NIST “[p]erformed a full rewrite of the previous content to improve clarity and usability and to remove outdated material,” and “[s]hifted the focus of the document from guidelines on detecting, analyzing, prioritizing, and handling incidents to recommendations and considerations for incorporating cybersecurity incident response considerations throughout an organization’s cybersecurity risk management activities.”

Figure 1. Revision 3 Incident response life cycle model based on CSF 2.0 Functions

Figure 2. Previous incident response life cycle model.

Revision 3 includes multiple significant updates, including:

• Mapping Directly to NIST Cybersecurity Framework 2.0 – As the prior Revision 2 of NIST 800-61 was published in 2012, before the publication of the NIST Cybersecurity Framework 1.0 in 2014, Revision 2 does not map to the NIST Cybersecurity Framework.  For the first time, NIST 800-61 Revision 3 “uses the [Cybersecurity Framework] 2.0 Functions, Categories, and Subcategories to organize its recommendations, considerations, and other information regarding incident response.”  In light of this update, entities might also consider revisiting and updating their own incident response policies and procedures to reflect recent changes in Revision 3 and Cybersecurity Framework 2.0.

• Life Cycle Model Restructure –  Revision 3 proposes a new Incident Response Life Cycle Model that, according to NIST, seeks to address a changed incident response landscape where incidents occur more frequently and are increasingly complex and dynamic.  As a result, the new Life Cycle Model in Revision 3 recognizes that incident preparation activities, which fall under Govern, Identify, and Protect in the Cybersecurity Framework, are not limited to incident response but reflect broader, ongoing cybersecurity risk management and incident preparation activities.  Therefore, these Cybersecurity Framework functions are now broken out into the bottom level, or foundation, of the Life Cycle Model, labeled “Preparation”.  By contrast, activities specific to incident response—which fall under the functions Detect, Respond, and Recover—make up the top level, titled “Incident Response”.  In addition, the new Life Cycle Model includes a middle section, titled “Lessons Learned” to emphasize the importance of continuous improvement (tied to the Identify Function within the Cybersecurity Framework).  In updating the life cycle model, NIST acknowledges that every organization varies, and as a result, the appropriate life cycle framework or model may also vary by organization (e.g., “larger and more technology-dependent organizations are likely to benefit more from using a framework or model emphasizing continuous improvement”).  Ultimately, NIST emphasizes that whatever the model used, incident response should be integrated as part of an organization’s broader cybersecurity risk management activities.
• Cybersecurity Framework Recommendations – Revision 3 includes a significant number of recommendations and substantive considerations in two new extensive tables that explicitly map to the functions, categories, and subcategories in the Cybersecurity Framework.  One table addresses the functions related to preparation and lessons learned (Govern, Identify, and Protect), and the other addresses functions more specifically related to incident response (Detect, Respond, and Recover).  As a few examples, some of the key recommendations from these tables that are marked as high priority are: 1) the synchronization of business continuity plans with incident response plans since incidents have the potential to undermine business continuity; 2) the implementation of continuous monitoring “for unauthorized activity, deviations from expected activity, and changes in security posture,” which should involve monitoring of networks and network services, hardware and software, personnel activity and technology usage, and external service provider activities; and 3) consideration for how to use and rely upon technological solutions to filter large, potentially adverse, event datasets down to a subset that is suitable for human viewing and analysis.
• Continuous Improvement – Another point of emphasis for Revision 3 is a greater focus on flexibility and a continued cycle of learning as part of ongoing incident response preparation and cybersecurity risk management.   While most entities have included lessons learned at the conclusion of their incident response processes, Revision 3 suggests that lessons learned can also be a continuous process informing preparation, the incident response, as well as recovery to “keep up with modern threats.”  In addition to after action reviews following an incident, entities can implement this recommendation through periodic tabletop exercises as well as integrating learnings from periodic risk assessments or reviews of their broader cybersecurity program into their incident response procedures.

Finally, Revision 3 recognizes that details of incident response best practices “change so often and vary so much across technologies, environments, and organizations, it [therefore] is no longer feasible to capture and maintain . . . information in a single static publication.”  Instead, given the rapid pace of incident response, NIST established a new Incident Response website where NIST will host links to incident response resources.  NIST said that “[b]y moving links from [SP 800-61] to a website, NIST can update and expand them as needed without having to release a new version of [SP 800-61].”