Incident Response Explained: 7 Steps and NIST SP 800-61 Rev. 3
Security OperationsCISSPSecurity+CySA+
When a security incident hits, your team needs to know what to do first and what to do next. In this video, I'll walk through incident response: how an event becomes an incident, the seven incident management steps, how NIST changed its model in April 2025 with SP 800-61 Rev. 3 and CSF 2.0, and how it compares with older models.
What you will learn
- What incident response is, and how it fits inside incident management
- Event vs alert vs incident
- The seven steps: detection, response, mitigation, reporting, recovery, remediation, lessons learned
- NIST SP 800-61 Rev. 3 (April 2025): preparation, response and improvement levels built on CSF 2.0
- Other models: NIST Rev. 2 four phases and the SANS six steps
- Three tip ideas: counterattack ≠ response; recovery ≠ remediation; lessons ≠ end only