what actually happened
NIST withdrew SP 800-61 Revision 2 and published Revision 3, which drops the phase model and restructures incident response around the six functions of the Cybersecurity Framework 2.0.
Most training material, most vendor diagrams and a great many internal runbooks still show the old cycle. That is not urgent to fix, but if your documentation cites Rev 2 by name it is citing something that no longer exists, and an auditor will eventually notice.
The old phases were: Preparation → Detection and Analysis → Containment, Eradication and Recovery → Post-Incident Activity. Useful as a teaching sequence, and that is roughly what it has become.
why it matters, in one paragraph
A cycle has an entrance and an exit. Teaching response as a cycle quietly teaches that response is an event: something you begin when an alert fires and finish when the report is filed. The function model treats it as continuous, and it puts Govern underneath everything else.
That last part is the substance. Most response failures do not happen in the analysis. They happen because nobody on duty was allowed to decide anything, and the old model had nowhere to put that.
Govern
Who decides, and what they are allowed to decide without asking.
when something is runningIt is already too late to establish this. Govern is the function that determines whether your response takes twenty minutes or six hours, and it is settled months beforehand.
where it fails in practiceAn analyst who can see the compromised host but cannot isolate it without a change request. The detection worked, the analysis was right, and the intrusion continued for another shift because nobody on duty had the authority to act on it.
what it looks like when done
- A named person who can authorise isolating a production host at 3am, and a named deputy
- A written threshold for when legal and the data protection lead are told, not a judgement call
- A decision on paying ransoms made before anyone is asked to make it under pressure
- Retention periods set against your own detection times rather than against a default
Identify
What you have, what it is worth, and where the evidence would be.
when something is runningThe difference between scoping in an hour and scoping in a week. An accurate asset inventory is the least glamorous artifact in security and the one most often missing at the moment it is needed.
where it fails in practiceNobody can say what the compromised server does, who owns it, or whether the data on it is regulated. The investigation stalls on a question that has nothing to do with forensics.
what it looks like when done
- An inventory that says what a host does and who owns it, not just that it exists
- Knowing which systems hold regulated data, before somebody asks whether they were touched
- A map of which log sources cover which assets, and the gaps stated rather than assumed
Protect
The controls that make the intrusion smaller.
when something is runningMostly settled already, with one live exception: the credential hygiene that decides whether one compromised workstation stays one workstation.
where it fails in practiceA service account with local administrator on every server and a password unchanged since 2021. Nothing detects it because nothing is wrong with it until somebody dumps LSASS.
what it looks like when done
- Tiered administrative access, so a workstation credential cannot reach a domain controller
- Service accounts reviewed for interactive logon rights and password age
- Backups tested by restoring, not by the backup product reporting success
- PowerShell script block logging on, which is free and is the highest-value log on a Windows estate
Detect
Noticing, and noticing in time to matter.
when something is runningThe clock on everything else starts here. Measured properly, from the earliest evidence in the logs rather than from when an alert happened to fire.
where it fails in practiceThe detection existed and had been switched off. A false positive in March, turned to audit-only as a reasonable emergency measure, and nothing ever brought it back because there was no record it had been turned off.
what it looks like when done
- Every suppression carrying an owner and an expiry date
- Detections validated by firing the technique and watching it alert, not by the rule existing
- Coverage measured against the techniques relevant to your estate, not all of ATT&CK
Respond
Containing it, understanding it, and telling the people who must be told.
when something is runningThe part everybody rehearses and the part that most depends on Govern having been done. The analysis is rarely the bottleneck.
where it fails in practiceRestoring from backup before establishing the way in, and being encrypted again the same week. Or containing so fast that the evidence needed to scope the incident is destroyed with it.
what it looks like when done
- Volatile evidence collected before containment where the two conflict, and a rule about which wins
- Notification thresholds already written, so the clock is not spent deciding whether the clock started
- An incident record separating what was observed from what was assessed
Recover
Getting back, and being harder to do it to again.
when something is runningBegins earlier than most plans assume, and it is where the incident either produces a change or does not.
where it fails in practiceThe report is written, filed, and nothing changes. A lesson is not learned until behaviour changed and somebody checked; until then it is only a lesson observed.
what it looks like when done
- Rebuild rather than clean, with the way in closed before anything returns to service
- Every recommendation carrying an owner and a date, not a paragraph
- A revisit some weeks later to check the change survived contact with normal work
using this without rewriting everything
You do not need to restructure your runbooks around six functions to benefit from this. The useful exercise is smaller: take your last real incident and ask which function the delay came from. If the honest answer is Govern rather than Detect or Respond, that is a finding, and it is one the old model made it hard to even phrase.
