TL;DR
- NIST 800-61r2 is the IR lifecycle reference: Preparation → Detection/Analysis → Containment/Eradication/Recovery → Post-Incident Activity.
- The highest leverage work happens before incidents: logging, contacts, playbooks, and access.
- It’s practical, not trendy: if you implement the basics here, your “day 0” response becomes survivable.
What it is
A NIST Special Publication describing how an organization should structure incident response: roles, processes, communications, and metrics.
Key ideas (worth stealing)
- Define what an incident is in your org (severity + business impact), not just “security event.”
- Build an IR capability, not a document: tooling + people + authority.
- Treat evidence like an asset: time sync, logs retention, and chain-of-custody discipline.
- Post-incident isn’t optional: you need lessons learned and control improvements (otherwise you’ll repeat the breach with better slides).
Recommended actions
- Now:
- Create an on-call escalation path + a single “declare incident” mechanism.
- Ensure central logging exists for auth, endpoints, cloud control plane.
- Soon:
- Write containment playbooks for your top 3 risks (credential theft, ransomware, SaaS compromise).
- Set up forensic-friendly defaults (time sync, retention, immutable audit logs).
- Later:
- Add metrics (MTTD/MTTR), tabletop exercises, and cross-team comms templates.
Notes / caveats
- It’s older, but the lifecycle still maps cleanly onto modern SaaS/cloud incidents.
- Pair with vendor-specific cloud guidance (AWS/GCP/Azure) for concrete log sources and controls.
Links
- Primary: NIST SP 800-61r2 PDF