What it covers. NIST guidance that aligns incident response with the NIST Cybersecurity Framework 2.0, published as a community profile. Rather than a standalone life cycle, it treats incident response as part of broader risk management, linking preparation, detection, response and recovery activities to the CSF functions.
In practice. Applying it well means defining roles, escalation paths and decision authority before an incident, and integrating response with governance, asset management and recovery planning. Organisations exercise their plans, keep contact lists current, and feed lessons learned back into risk management. Evidence includes approved plans, exercise reports, incident records with timelines and tracked improvement actions.
Common gaps. Organisations often keep an outdated plan modelled on the earlier four-phase life cycle, fail to involve legal, communications and leadership, and do not follow up on lessons learned.