Incident response frameworks compared: NIST, SANS PICERL and ISO/IEC 27035
In short: Incident response models all describe the same journey: prepare, find the incident, stop it, clean up, recover and learn. NIST SP 800-61 Rev. 2 uses four phases, SANS PICERL uses six steps, NIST Rev. 3 (2025) ties response to the six CSF 2.0 functions, and ISO/IEC 27035 suits organisations using ISO 27001. Pick one and use its language consistently.
Why there are several models
When you study incident response you quickly meet different lists of phases. Job adverts mention "PICERL", policies quote "NIST 800-61", and auditors ask about "ISO 27035". This can feel confusing, but the models agree far more than they differ. Each describes how to prepare for incidents, handle them in a controlled way and learn from them. The note on the incident response lifecycle walks through the phases in practice; this note compares the frameworks so you can recognise each one.
NIST and SANS side by side
| NIST SP 800-61 Rev. 2 | SANS PICERL | What happens |
|---|---|---|
| Preparation | Preparation | Plan, team, tools, logging, training, exercises |
| Detection and analysis | Identification | Notice something, confirm it is an incident, judge scope and severity |
| Containment, eradication and recovery | Containment | Stop the spread, for example isolate hosts or disable accounts |
| Eradication | Remove malware, close the entry point, reset credentials | |
| Recovery | Restore systems carefully and monitor for return | |
| Post-incident activity | Lessons learned | Review, report, improve controls and the plan |
The real difference is emphasis. SANS separates containment, eradication and recovery because they are often done by different people at different times. NIST groups them because in practice teams move back and forth between them as they learn more.
What changed in NIST SP 800-61 Rev. 3
In April 2025 NIST published Revision 3 of SP 800-61. Instead of a stand-alone lifecycle, it presents incident response as part of overall cyber security risk management, organised around the six functions of the NIST Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The message is that response does not start when an alert fires. Governance decides who has authority, identification tells you what matters, protection reduces how many incidents happen, and every incident should feed improvements back into all six areas. Many organisations still teach the Rev. 2 phases because they are easy to follow during an incident, and the two fit together well.
ISO/IEC 27035 and choosing a model
ISO/IEC 27035 is the international standard for information security incident management. It covers planning and preparing, detecting and reporting, assessment and decision, responses, and lessons learned. It is a natural choice if you already run an ISO/IEC 27001 management system, because auditors will expect your process to line up with it.
- Use NIST if your organisation already uses the CSF or works with US partners.
- Use PICERL if you want simple, teachable steps for a small team.
- Use ISO/IEC 27035 if you are certified to, or working towards, ISO/IEC 27001.
Tip: whichever model you choose, use the same phase names in your plan, tickets, reports and exercises. Shared language avoids confusion when people are tired and under pressure.
Real-world example: one plan for two audiences
A fictional engineering consultancy holds ISO/IEC 27001 certification, but its new managed SOC provider writes reports using PICERL. Rather than rewrite everything, the security manager adds a one-page mapping table to the incident response plan showing how each PICERL step matches the ISO/IEC 27035 stages. Incident tickets use PICERL step names, while the annual audit evidence references the ISO stages. Both the SOC and the auditor can follow the same incident records without confusion.
Practice
Which PICERL steps match the NIST Rev. 2 phase "containment, eradication and recovery"?
What is the main idea behind NIST SP 800-61 Rev. 3?
When would ISO/IEC 27035 be the natural choice?
Key takeaways
- All major models describe prepare, detect, contain, clean up, recover and learn.
- NIST Rev. 2 has four phases; SANS PICERL has six steps.
- NIST SP 800-61 Rev. 3 (2025) builds response around CSF 2.0.
- ISO/IEC 27035 fits organisations using ISO/IEC 27001.
- Pick one model and use its terms consistently.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.