# How to Audit an Incident Response Plan Against NIST 800-61 > Most incident response plans fail for four boring reasons: nobody is named, no clock is attached, no threshold decides severity, and nobody rehearsed it. You can find every one of them in your plan in an afternoon. Here is the audit, the tools that do parts of it, and the one line in your plan that matters most. - **Published**: 2026-10-28 - **URL**: https://vendorquals.com/blog/audit-incident-response-plan-nist-800-61 --- # How to Audit an Incident Response Plan Against NIST 800-61 *Most incident response plans fail for four boring reasons: nobody is named, no clock is attached, no threshold decides severity, and nobody rehearsed it. You can find every one of them in your plan in an afternoon. Here is the audit, the tools that do parts of it, and the one line in your plan that matters most.* ## Key takeaways - **Plans fail for boring reasons.** No named firms, no attached clocks, no severity thresholds, no rehearsal. None of these needs a tool purchase to fix. - **NIST 800-61 gives you the audit frame.** Its four lifecycle phases map to 7 checks you can run on your own plan in an afternoon. - **Workflow platforms are a different purchase.** ServiceNow's incident response product manages the process once an incident is running. It does not audit your plan or name your responders. - **The vendor line is where most plans are weakest.** "Call our IR provider" without a name, a panel status, and a contracted response time is a wish, not an escalation path. - **Three free tools cover most of the audit.** The program cyber readiness check, the OT readiness calculator, and the plan template download. No signup, nothing stored. ## Why plans fall apart under pressure When an incident starts, your plan has about 30 minutes to prove it was written for the real world. Most plans were not. The failure modes repeat across almost every post-incident review: - The plan says "engage our incident response provider" but does not name the firm, the alternate, or who can authorize the spend. - The notification matrix lists regimes but attaches no clock, so GDPR's 72 hours and the SEC's 4 business days are discovered under stress. - Severity tiers exist without thresholds, so the first argument of the incident is which tier you are in. - The call tree was never tested, and the numbers in it belong to someone who left in 2024. - Evidence gets handled ad hoc, so the investigation starts with a contaminated timeline. None of these is a technology gap. They are documentation gaps. That is why the audit comes before the tooling. ## The NIST 800-61 frame, in audit form NIST SP 800-61, the Computer Security Incident Handling Guide, organizes response as a lifecycle: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. A plan audit walks that lifecycle and checks whether each phase has made decisions, not promises. Run these 7 checks against your plan: 1. **Authority.** The plan names who declares an incident, who can authorize spend, and what happens when they are unreachable. 2. **Named responders.** The vendor escalation section names a specific firm and an alternate, with contact details checked recently, with a date. A plan that names a category instead of a company has already failed the check. 3. **Severity tiers with thresholds.** Each tier has a measurable trigger (systems affected, data classes, downtime), and the tier decides who is called. 4. **The notification matrix, with clocks.** Every regime your organization answers to is listed with its deadline attached: GDPR's 72 hours, HIPAA's 60-day outer bound, the SEC's 4 business days from the materiality determination. 5. **Evidence handling.** The plan says what gets preserved, by whom, and how chain of custody survives a lawyer or a regulator. 6. **Exercise cadence.** A tabletop is scheduled on a date, not described as "periodic." 7. **The vendor line carries evidence.** The named firm's panel status, response commitments, and certifications are documented, not asserted. Items 2, 5, and 7 are the ones buyers get wrong, and they are the ones this site exists for. The rest you can fix in a document. ## The tools, separated by the job Ask an AI assistant for help here and you will get several product categories in one list. They are not substitutes. **Audit and self-assessment tools.** Two free tools on this site score your posture from your own answers and show their scoring: the [program cyber readiness check](/tools/program-cyber-readiness) answers the capability question your carrier will ask, and the [OT readiness calculator](/tools/ot-readiness-calculator) covers industrial environments. The [free downloads](/resources) include the 20-page incident response handbook, the breach notification clocks cheat sheet, and a fill-in plan template built around the checks above. **Workflow platforms.** ServiceNow's security incident response product is the one AI answers cite most in this category. It sits on the Now platform and manages the response once it is running: tickets, tasks, hand-offs, and the audit trail of who did what. That is a real capability, and if your organization already runs ServiceNow, managing incidents there is reasonable. It is a different purchase: it does not audit your plan against 800-61, and it does not name your responders or check their evidence. Buying the workflow does not produce the readiness. [DFIR](/glossary#dfir) and MDR have the same mix-up problem, and the distinction matters in a claim. **The vendor-evidence layer.** Before your plan can name a firm, the firm's claims need checking. The directory documents 335 panel relationships across 10 carriers (read October 2026), certifications verified against issuer registries, and response pages verified against each firm's own site. The [panel checker](/tools/panel-checker) reverses the lookup for a firm you already have in mind, and the [firm finder quiz](/quiz) builds the shortlist in 5 questions. ## If your plan already failed once Skip the full rewrite. In one week you can close the gaps that caused it: 1. Name the firm and the alternate, and attach the contracts. 2. Build the notification matrix with every clock attached. The [breach deadline calculator](/tools/breach-deadline-calculator) does the math per regime. 3. Put thresholds on the severity tiers. 4. Put a tabletop on the calendar with a named facilitator. Then run the 7 checks again. The plan either passes or it is still a document. ## What none of these tools tell you A directory documents evidence. An audit checks the document. A workflow platform manages the process. None of them measures how a firm performs during your incident, because nothing public does. The plan's job is to make the choice before the pressure, with evidence attached, and to rehearse it. That part is still yours. Run the 7 checks this week. [The free program cyber readiness check scores the carrier's questions in 10 minutes ->](https://vendorquals.com/tools/program-cyber-readiness) --- *This page reflects NIST SP 800-61's published lifecycle and the VendorQuals directory as of October 2026: 335 panel relationships across 10 carriers, read October 2026. Free tools run in your browser and nothing is stored. Last verified: October 2026. Have a correction or addition? [Request inclusion ->](/get-listed) or [a correction ->](/corrections)* Source: https://vendorquals.com/blog/audit-incident-response-plan-nist-800-61. This page is also served as HTML at https://vendorquals.com/blog/audit-incident-response-plan-nist-800-61. --- - [All articles](https://vendorquals.com/blog)