Sources and attribution

This tool is based on NIST Special Publication 800-61 Revision 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025). Every step in the plan carries the NIST identifiers it implements.

NIST describes outcomes to reach, not click-by-click instructions. The practical detail in our steps comes from the public guidance listed below and from general incident-response practice. NIST publications are not subject to copyright in the United States; NIST asks for attribution, which we give here. This is an independent tool and is not affiliated with or endorsed by NIST, CISA, the FTC, HHS, or any other agency.

Where to read the originals

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025)

  The backbone of this tool. Supersedes SP 800-61 Rev. 2.

• NIST SP 800-61 Rev. 3 (PDF)

  The document we downloaded and read.

• NIST Cybersecurity Framework (CSF) 2.0

  Govern, Identify, Protect, Detect, Respond, Recover.

• CISA — Cybersecurity Incident & Vulnerability Response Playbooks

  Referenced by NIST for playbook examples.

• CISA — #StopRansomware Guide

  Ransomware response checklist.

• FTC — Data Breach Response: A Guide for Business

  Practical guidance for small businesses.

• HHS — HIPAA Breach Notification Rule

  For HIPAA covered entities and business associates.

• FBI Internet Crime Complaint Center (IC3)

  Report cyber crimes, including fraudulent wires.

What this tool does not cover yet

• US state breach-notification laws (they apply to most incidents involving US residents).
• Laws outside the United States.
• Specific notification deadlines. We're verifying each federal rule against primary sources first and will publish them with source links and a last-verified date.

Spot an error or an out-of-date item? Tell us.