All regulations & standards
Standards & frameworks · Regulation & standard

NIST SP 800-61r3 scenario testing with simulations

What is NIST SP 800-61r3?

NIST SP 800-61 Revision 3 provides incident response recommendations aligned with NIST CSF 2.0.

iluminr simulations let teams rehearse the decisions NIST SP 800-61r3 cares about against severe-but-plausible scenarios, and keep a record of who decided what, and when. Run them as Microsimulations, full-scale simulations, or facilitated by our team of experts.

Build a 12-month NIST SP 800-61r3 programOpen in the catalogue

Simulations mapped to NIST SP 800-61r3

Phone call in the dark, illustrating the Bracing for Impact: Communications Test MicrosimulationCyber & DataBracing for Impact: Communications TestTest your organization's ability to send timely Emergency Notifications in response to a sophisticated, self-learning malware threat that targets critical infrastructure.Code on a dark screen, illustrating the Data Breach: Major Leak MicrosimulationCyber & DataData Breach: Major LeakA massive data breach has struck some of the world’s largest organizations, including your own, leading to the potential compromise of sensitive personal information. The breach has exposed the names, phone numbers, and addresses of millions of customers, raising immediate concerns about privacy, identity theft, and the security of your data handling practices.Code on a dark screen, illustrating the Extortion: Ransomware Invasion MicrosimulationCyber & DataExtortion: Ransomware InvasionAddress a widespread ransomware attack demanding cryptocurrency payments, focusing on stakeholder communication and restoring operational control.Code on a dark screen, illustrating the Inside Job: Data Breach MicrosimulationCyber & DataInside Job: Data BreachNavigate the high-stakes initial response to a sophisticated insider threat that has compromised sensitive organizational data, testing your incident response protocols when the threat comes from within.Trading screens in the dark, illustrating the Trading Halt: Ransomware Chaos MicrosimulationCyber & DataTrading Halt: Ransomware ChaosAddress a major ransomware attack causing a service outage, suspected to be state-sponsored, by coordinating with cybersecurity experts and effectively communicating with stakeholders.Code on a dark screen, illustrating the Double Tap: Cyber Attack MicrosimulationCyber & DataDouble Tap: Cyber AttackA major information services provider faces a cyber crisis, leading to system outages, regulatory scrutiny, and eroded client trust. Participants will manage rapid response adjustments, client communication, and rebuilding credibility under intense pressure.Code on a dark screen, illustrating the Evolved: Adaptive Malware MicrosimulationCyber & DataEvolved: Adaptive MalwareA sophisticated form of malware has caused disruption across global health services, telecommunication and technology providers.Phone call in the dark, illustrating the Vished: Customer & Regulatory Impacts MicrosimulationCyber & DataVished: Customer & Regulatory ImpactsA convincing voice-phishing call gives attackers a foothold, with consequences for customers and regulators. Assess the incident, identify the critical business functions at risk, and work through your regulatory obligations.Code on a dark screen, illustrating the Wage Gap: Data Breach Fallout MicrosimulationCyber & DataWage Gap: Data Breach FalloutAddress the aftermath of a data breach revealing pay inequity, focusing on stakeholder engagement, implementing corrective measures, and restoring organizational trust.Red warning sign reading breached, illustrating the Plan Under Pressure: Cyber Incident MicrosimulationCyber & DataPlan Under Pressure: Cyber IncidentA confirmed disruption is unfolding. You're drawn into the early response and asked whether a formal plan should be activated.Red padlocks over streams of code, illustrating the Account Takeover: Containment & Response MicrosimulationCyber & DataAccount Takeover: Containment & ResponseA suspected account compromise points to a data breach. Contain it, escalate it and coordinate across functions.

Mapping is indicative. Confirm scope against your own obligations.

Frequently asked questions

What is NIST SP 800-61r3?

NIST SP 800-61 Revision 3 provides incident response recommendations aligned with NIST CSF 2.0.

How do simulations help with NIST SP 800-61r3?

Simulations let teams rehearse the decisions NIST SP 800-61r3 cares about against severe-but-plausible scenarios. iluminr keeps a record of who decided what, and when, which you can use as evidence of testing.

Which iluminr simulations map to NIST SP 800-61r3?

Simulations mapped to NIST SP 800-61r3 include Bracing for Impact: Communications Test, Data Breach: Major Leak, Extortion: Ransomware Invasion, Inside Job: Data Breach, Trading Halt: Ransomware Chaos and Double Tap: Cyber Attack, among others.

Who should take part?

These simulations are most often run with Technology & Security, Risk, Compliance and Legal.

Can I build a 12-month NIST SP 800-61r3 testing program?

Yes. The iluminr program builder suggests a 12-month plan of simulations for NIST SP 800-61r3. You can add or remove scenarios and export the plan as a PDF for your board.

Can we customize these simulations?

Yes. Run any template as is, tailor the roles, plans, critical services and injects to your organization, or build your own from scratch with the iluminr builder.

Is this mapping legal or compliance advice?

No. The mapping between simulations and NIST SP 800-61r3 is indicative. Confirm scope against your own obligations.

More in Standards & frameworks