NIST SP 800-61 Revision 3 treats incident response as part of cybersecurity risk management across all six NIST CSF 2.0 Functions. Cybatar can support the operational records that connect preparation, detection, response, evidence, recovery and learning, while the organisation remains responsible for its actual response programme and decisions.
Authoritative external source
Final, published April 2025; supersedes SP 800-61 Rev. 2.
https://csrc.nist.gov/pubs/sp/800/61/r3/finalOperational evidence mapping
Establish roles, plans, escalation, communications and risk-management context before incidents.
Dependency / limit: A stored playbook is not evidence that personnel, communications or external dependencies are ready unless exercised.
Identify, triage, validate and understand potential incidents.
Dependency / limit: Detection quality depends on connected sources, tuning and analyst judgement.
Coordinate containment, investigation, communications and response tasks.
Dependency / limit: The platform does not make containment or legal decisions automatically.
Restore operations, verify remediation, communicate status and improve future response.
Dependency / limit: Recovery execution and business-continuity decisions remain organisation responsibilities.
Claim boundary
This page is not an official NIST implementation guide or Community Profile. It describes where Cybatar records may support an organisation applying SP 800-61r3. Conformance, legal obligations and response effectiveness require organisation-specific assessment.
These mappings are Cybatar-authored operational interpretations of public framework guidance. They are not official crosswalks, certifications, attestations, legal advice or statements of conformance.