ISC, Information Systems and Controls
Sources for Incident Response: The Four-Phase Lifecycle, SP 800-61r3, and Continuity Links
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Incident Response: The Four-Phase Lifecycle, SP 800-61r3, and Continuity Links. The topic rests on NIST SP 800-61r3 (Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025), the superseded SP 800-61r2 four-phase model (Computer Security Incident Handling Guide, August 2012, withdrawn 3 April 2025), NIST SP 800-34 Rev. 1 (Contingency Planning Guide for Federal Information Systems, May 2010, updated November 2010), and the NIST Cybersecurity Framework 2.0 Functions used by SP 800-61r3.
About this topic
At 06:10 an antivirus console lights up on four workstations in a finance department. Nothing in that moment says whether the right move is to unplug the machines, to watch quietly and gather evidence, to call a lawyer, or to do nothing at all. Deciding that in the right order, and having decided most of it long before the console lit up, is what this Topic is for.
The question this group answers. What an organization does between the first sign that something is wrong and the moment it can say the matter is closed, who decides each step, and which plan governs once the disruption outgrows the response.
Key points
- The NIST incident response lifecycle has four phases: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity.
- An incident response plan names roles, authorities, and escalation paths before an incident occurs.
- Business continuity planning ensures critical functions continue during and after a disruption.
- Recovery time objective (RTO) is how fast a system must be restored; recovery point objective (RPO) is how much data loss is acceptable.
What the lessons cover
- The incident response lifecycle
- Preparation
- Detection, containment, eradication, and recovery
- Post-incident activity and continuity links
- Incident prioritization and triage
- Evidence, chain of custody, and retention
- Incident notification, reporting, and information sharing
- Business continuity, disaster recovery, and the plan family
- Recovery objectives and alternate processing sites
- Incident response metrics and program improvement
- Incident response team models and staffing
Authoritative references
- NIST SP 800-61r3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025), which organizes incident response around the Functions of the NIST Cybersecurity Framework 2.0.
- NIST SP 800-61r2, Computer Security Incident Handling Guide (August 2012), the superseded source of the four-phase model, withdrawn on 3 April 2025.
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (May 2010, updated November 2010), the source of the plan family, the business impact analysis, the recovery objectives, and the alternate processing sites.
- NIST SP 800-84, the guide to test, training, and exercise programs for the plans.
- NIST Cybersecurity Framework 2.0, the Functions used by SP 800-61r3: Govern, Identify, Protect, Detect, Respond, and Recover.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.