Chapter 9 — Incident response

The current NIST incident-response publication is SP 800-61 Rev. 3 (final, April 2025), which supersedes Rev. 2, integrates incident response with CSF 2.0 risk management, and frames preparation, detection, response, and recovery as planned risk-management activities (NIST SP 800-61r3; official PDF). A practical first response: preserve evidence and logs; record times/time zone and observed facts; scope impact; contain proportionately; communicate/escalate; and recover from known-good sources — aligned to your organization's response plan and legal/reporting requirements.

The first-response card

Know in advance: who has authority to declare/coordinate an incident. During: preserve current logs and time context; note affected systems, accounts, networks, data; avoid destructive cleanup; contain with the least disruptive effective action; maintain a written timeline and evidence chain appropriate to policy; use trusted clean devices for recovery and credential rotation; notify required internal/external parties; recover from known-good sources; and conduct a post-incident review (NIST SP 800-61r3).

HIGH-RISK — incident actions can destroy evidence or worsen impact. Rebooting, wiping/reinstalling, deleting suspicious files, running repair tools, rotating credentials from a potentially compromised host, or restoring backups without scoping can erase volatile evidence or reinfect the environment (NIST SP 800-61r3). Preflight: scope before acting; confirm the containment action's blast radius. Rollback: containment should itself be reversible where feasible. Success check: impact contained and evidence preserved.

Two manual cross-references matter here. Journal vacuuming during an incident deletes the only timeline — export first, vacuum only under retention policy (Chapter 3, journalctl(1)). And local logs alone do not survive host loss: forwarding critical logs off-host (Chapter 7) is what makes post-incident analysis possible.