Computer Security Incident Handling Guide

Cichonski, Paul; Millar, Thomas; Grance, Tim; Scarfone, Karen

doi:https://doi.org/10.6028/NIST.SP.800-61r2

SP 800-61 Rev. 2

Computer Security Incident Handling Guide

Documentation Topics

Date Published: August 2012

Supersedes: SP 800-61 Rev. 1 (03/07/2008)

Planning Note (3/20/2023): Send inquiries about this publication to 800-61-comments@nist.gov.

Author(s)

Paul Cichonski (NIST), Thomas Millar (DHS), Tim Grance (NIST), Karen Scarfone (Scarfone Cybersecurity)

Abstract

Computer security incident response has become an important component of information technology (IT) programs. Because performing incident response effectively is a complex undertaking, establishing a successful incident response capability requires substantial planning and resources. This publication assists organizations in establishing computer security incident response capabilities and handling incidents efficiently and effectively. This publication provides guidelines for incident handling, particularly for analyzing incident-related data and determining the appropriate response to each incident. The guidelines can be followed independently of particular hardware platforms, operating systems, protocols, or applications.

Keywords

computer security incident; incident handling; incident response; threats; vulnerabilities

Control Families

Incident Response; System and Information Integrity

Documentation

Publication:
SP 800-61 Rev. 2 (DOI)
Local Download

Supplemental Material:
Press Release (other)

Document History:
08/06/12: SP 800-61 Rev. 2 (Final)

Topics

Security and Privacy
incident response; maintenance; risk assessment; threats; vulnerability management

Laws and Regulations
Federal Information Security Modernization Act