[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-61":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",283,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance that aligns incident response with the NIST Cybersecurity Framework 2.0, published as a community profile. Rather than a standalone life cycle, it treats incident response as part of broader risk management, linking preparation, detection, response and recovery activities to the CSF functions.\n\n**In practice.** Applying it well means defining roles, escalation paths and decision authority before an incident, and integrating response with governance, asset management and recovery planning. Organisations exercise their plans, keep contact lists current, and feed lessons learned back into risk management. Evidence includes approved plans, exercise reports, incident records with timelines and tracked improvement actions.\n\n**Common gaps.** Organisations often keep an outdated plan modelled on the earlier four-phase life cycle, fail to involve legal, communications and leadership, and do not follow up on lessons learned.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F61\u002Fr3\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"nist-nsa-cisa-issue-guidance-on-ai-incident-readiness-for-high-risk-ai-systems","NIST, NSA & CISA Issue Guidance on AI Incident Readiness for High-Risk AI Systems","2026-10-16T18:21:54.014+00:00",{"slug":23,"title":24,"published_at":25},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":27,"title":28,"published_at":29},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":31,"title":32,"published_at":33},"phishing-as-a-service-how-yam-store-weaponized-cloud-infrastructure-at-scale","Phishing-as-a-Service: How Yam Store Weaponized Cloud Infrastructure at Scale","2026-10-14T22:20:50.865+00:00",{"slug":35,"title":36,"published_at":37},"billion-message-phishing-campaign-disrupted-by-microsoft-coalition","Billion-Message Phishing Campaign Disrupted by Microsoft Coalition","2026-10-14T20:21:09.517+00:00",{"slug":39,"title":40,"published_at":41},"chinese-language-phishing-as-a-service-market-disrupted-after-1b-malicious-messages","Chinese-Language Phishing-as-a-Service Market Disrupted After 1B+ Malicious Messages","2026-10-14T14:21:21.247+00:00",{"slug":43,"title":44,"published_at":45},"ransomware-groups-escalate-to-physical-threats-against-employees-and-families","Ransomware Groups Escalate to Physical Threats Against Employees and Families","2026-10-14T06:20:17.072+00:00",{"slug":47,"title":48,"published_at":49},"insider-threat-openai-employee-plants-audio-device-in-conference-room","Insider Threat: OpenAI Employee Plants Audio Device in Conference Room","2026-10-14T00:20:50.023+00:00",{"slug":51,"title":52,"published_at":53},"international-operation-dismantles-west-african-scam-networks","International Operation Dismantles West African Scam Networks","2026-10-13T18:21:28.9+00:00",{"slug":55,"title":56,"published_at":57},"tfg-london-cyberattack-hits-multiple-retail-brands-across-shared-it-infrastructure","TFG London Cyberattack Hits Multiple Retail Brands Across Shared IT Infrastructure","2026-10-13T18:21:02.732+00:00",{"slug":59,"title":60,"published_at":61},"mssps-must-shift-left-proactive-threat-hunting-is-the-new-ransomware-defense","MSSPs Must Shift Left: Proactive Threat Hunting Is the New Ransomware Defense","2026-10-13T12:20:17.419+00:00",{"slug":63,"title":64,"published_at":65},"ahold-delhaize-disconnects-systems-after-repeat-cyberattack","Ahold Delhaize Disconnects Systems After Repeat Cyberattack","2026-10-13T10:20:19.073+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",98,{"slug":73,"name":74,"problem":75,"stories":76},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",55,{"slug":78,"name":79,"problem":80,"stories":81},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",51,{"slug":83,"name":84,"problem":85,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",40,{"slug":88,"name":89,"problem":90,"stories":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":92,"name":93,"problem":94,"stories":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",38,[97,102,108,113,119,124,129,133],{"family":98,"item":99,"code":100,"title":100,"together":101},"itil","overview","ITIL",164,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","17","Control 17","Incident Response Management",163,{"family":103,"item":109,"code":110,"title":111,"together":112},"13","Control 13","Network Monitoring and Defense",118,{"family":114,"item":115,"code":116,"title":117,"together":118},"gdpr","32","Article 32","Security of processing",107,{"family":103,"item":120,"code":121,"title":122,"together":123},"7","Control 7","Continuous Vulnerability Management",79,{"family":103,"item":125,"code":126,"title":127,"together":128},"14","Control 14","Security Awareness and Skills Training",73,{"family":114,"item":130,"code":131,"title":132,"together":128},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":134,"item":135,"code":136,"title":137,"together":138},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",65]