Standards preparation checklist
Incident Response and Evidence Readiness
Prepare the decisions, access, records and recovery arrangements needed for a cybersecurity incident. Uses selected CSF 2.0 outcomes from the incident-response profile.
Baseline: NIST SP 800-61 Rev. 3 and CSF 2.0. Prepared November 1, 2026.
Are incident roles and decision authorities clear?
Identify the incident lead, technical responders, business owner and people authorized to approve disruptive actions. Include outside providers where they have response duties.
Evidence to gather
Role assignments, decision authority, escalation contacts and service arrangements.
If something is missing
Resolve ambiguous approval responsibilities before an incident forces a rushed decision.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, GV.RR-02; PDF page 21. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Does the response plan match the business and its dependencies?
Connect response to business continuity and the services needed to keep operating. A generic procedure may omit the cloud provider, outside administrator or operational system the organization relies on.
Evidence to gather
Current response/continuity plans, critical services and dependency records.
If something is missing
Review the plans together and identify assumptions about external support.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, ID.IM-04 and GV.OC-05; PDF page 28. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can a reported event reach someone who can assess it?
Include reports from employees, customers and service providers. Identify how reports are monitored and triaged, including when normal working arrangements are disrupted.
Evidence to gather
Reporting channels, duty arrangements and representative triage records.
If something is missing
Confirm the route using an authorized exercise rather than sending a fabricated production incident.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.MA-02; PDF page 35. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are severity and escalation decisions based on impact?
Evaluate affected functions, data, asset criticality and recoverability. Handling incidents strictly in arrival order can direct attention away from a more consequential event.
Evidence to gather
Severity criteria, escalation thresholds and example decisions.
If something is missing
Agree on risk factors and who can raise the incident to a higher response level.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.MA and RS.MA-03/04; PDF page 34. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can responders identify the affected assets and service owners?
Keep current hardware, software, service and data-flow records accessible to the response team. Include external hosting and SaaS systems rather than limiting the list to office devices.
Evidence to gather
Inventories, owners, service providers and authorized network/data-flow records.
If something is missing
Resolve the most important ownership or visibility gaps before an emergency.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, ID.AM-01/02/03; PDF page 24. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are the right records available when an event is examined?
Identify identity, email, endpoint, network and cloud records actually retained. Access rights, licensing and retention can affect availability. A blank search result alone does not establish that no activity occurred.
Evidence to gather
Logging coverage, example exports, retention, administrator contacts and known gaps.
If something is missing
Arrange approved access and document the missing sources that could limit analysis.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, DE.CM-06 and DE.CM-09; PDF page 32. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can adverse events be analyzed in context?
An alert or anomaly is an observation that needs interpretation. Define how technical evidence, threat information and business context are evaluated before an event is declared an incident.
Evidence to gather
Analysis workflow, available context, escalation criteria and representative case records.
If something is missing
Identify where specialized analysis is needed and how it can be obtained.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, DE.AE-02 and DE.AE; PDF page 33. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are cloud, vendor and insurer response handoffs understood?
Bring relevant third parties into planning and exercises. Confirm contractual contacts, access arrangements and any conditions on engaging outside assistance. Do not assume an IT support contract includes every forensic task.
Evidence to gather
Provider agreements, response contacts, handoff responsibilities and relevant policy conditions.
If something is missing
Clarify the missing handoffs with the authorized business and legal contacts.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, GV.SC-05 and GV.SC-08; PDF page 23. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are response actions and decisions recorded as they happen?
Keep an incident chronology that identifies actions, responsible people, timing and known effects. Protect those records from unauthorized alteration or disclosure.
Evidence to gather
Incident log template, record owner, storage/access controls and time basis.
If something is missing
Agree on a recording method that remains usable if normal collaboration tools fail.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.AN-06; PDF page 37. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can incident data be preserved with its origin and integrity?
Plan how relevant data and metadata will be collected and retained. The method and handling record should remain explainable. Sensitive material belongs in an agreed transfer process, not an ordinary inquiry form.
Evidence to gather
Preservation procedure, collection authority, source references and handling records.
If something is missing
Discuss the evidence scope and secure transfer with the response lead and counsel where appropriate.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.AN-07; PDF page 37. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Is containment authorized and suited to the affected service?
Isolation, account restrictions and service shutdowns can prevent further damage but may also disrupt essential activity. Define decision criteria, authority and the treatment of urgent exceptions.
Evidence to gather
Containment playbooks, approval rights, operational dependencies and temporary-measure expiry.
If something is missing
Walk through a representative containment decision with the service owner.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.MI-01; PDF page 40. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Does the scope review look beyond the first affected device?
An incident can include persistence, additional accounts and other systems. Define how the team will assess magnitude, distinguish confirmed observations from assumptions and revisit the scope as evidence changes.
Evidence to gather
Scope assessment, examined sources, limitations and unresolved hypotheses.
If something is missing
Assign the next evidence-gathering steps instead of declaring closure from one clean device.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.AN-08; PDF page 37. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are notification and communication decisions assigned?
Identify who determines applicable obligations, approves messaging and informs affected stakeholders. Requirements depend on the organization and incident; the checklist supplies no universal reporting deadline.
Evidence to gather
Communication plan, counsel contact, approval route and relevant contractual obligations.
If something is missing
Have authorized legal and business owners confirm the applicable decisions and timetable.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.CO-02 and RS.CO-03; PDF page 38. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can the team separate containment from removing the cause?
Stopping immediate spread does not demonstrate that persistence or underlying weaknesses have been addressed. Track eradication work and the evidence supporting each completed action.
Evidence to gather
Remediation records, affected asset list, verification results and unresolved issues.
If something is missing
Keep incomplete actions visible and agree on what must be checked before recovery proceeds.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RS.MI-01 and RS.MI-02; PDF page 40. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are recovery materials checked before restoration?
A backup or installation image may contain corruption or signs of compromise. Define who checks the materials and how they are accepted for use.
Evidence to gather
Recovery-source checks, known-good references and acceptance records.
If something is missing
Resolve unexplained integrity findings before using the material in production.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RC.RP-03; PDF page 42. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Does recovery demonstrate that the business function works?
Restoring files or starting a server does not prove that an essential service is operating correctly. Confirm the order of restoration, system integrity and operating status with the owner.
Evidence to gather
Functional acceptance criteria, service-owner confirmation and post-restore monitoring.
If something is missing
Record the remaining limitations and who can approve the return to service.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RC.RP-04 and RC.RP-05; PDF page 42. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Have response and recovery been exercised with relevant partners?
Exercises can reveal missing contacts, inaccessible records or conflicting authority without waiting for a live incident. Include critical providers and the scenarios relevant to the business.
Evidence to gather
Exercise plan, attendance, observations and assigned follow-up actions.
If something is missing
Run an authorized tabletop or other suitable exercise and track the resulting work.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, ID.IM-02; PDF page 27. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Do closure criteria and lessons produce specific improvements?
Declare the end of recovery using agreed criteria and complete the incident record. Assign improvements to plans, monitoring, access or recovery rather than stopping at a lessons-learned meeting.
Evidence to gather
Closure criteria, after-action record, owners and follow-up dates.
If something is missing
Review outstanding actions with the accountable owner and schedule the next reassessment.
Topic reference: NIST SP 800-61 Rev. 3; Section 3, RC.RP-06 and ID.IM-03; PDF page 42. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date: