NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response

NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, was published by the National Institute of Standards and Technology in August 2006. Its authors are Karen Kent and Tim Grance of NIST and Suzanne Chevalier and Hung Dang of Booz Allen Hamilton. NIST's publication page lists it as Final with no withdrawal or supersession notice, and the document runs to 121 pages.

The purpose, in the guide's own words, is to help organisations investigate computer security incidents and troubleshoot some IT operational problems by giving practical guidance on computer and network forensics, from an IT point of view rather than a law enforcement one. It describes the forensic process and then, chapter by chapter, how to collect, examine and analyse four kinds of data: files, operating systems, network traffic and applications.

Its audience is incident response teams, forensic analysts, system and network administrators and security programme managers. That breadth is why it reads less like a laboratory manual and more like a guide to building a forensic capability inside an organisation, with policies, staffing and procedures given as much space as technique.

There is one edition. NIST's document history shows the Final version dated 1 September 2006 and nothing after it. The guide has not been revised, withdrawn or formally superseded, but parts of its subject have moved to newer documents: incident handling to NIST SP 800-61, whose Revision 3 of April 2025 aligns it with the NIST Cybersecurity Framework 2.0, and mobile devices to NIST SP 800-101 Rev. 1 of 2014. Read it as a current statement of process and a dated statement of technology.

The guide says of itself that it is not an all-inclusive step-by-step guide to a digital forensic investigation, not legal advice and not a basis for criminal investigations, and that readers should apply it only after consulting management and legal counsel. For law enforcement it points to the US Department of Justice first responder and examination guides.

The four phases of NIST SP 800-86 sit comfortably inside the acquisitive and investigative process classes of ISO/IEC 27043:2015, and its collection chapter is the incident-response cousin of ISO/IEC 27037:2012. Where the ISO/IEC standards are abstract and paid, this guide is concrete and free, which is why many Indian laboratories quote it in procedures even when their quality system is written to the ISO/IEC family.

For practitioners, the SWGDE Best Practices for Digital Evidence Collection (18-F-002, version 2.0) and the SWGDE Best Practices for Computer Forensic Acquisitions (17-F-002, version 2.1) carry the same ideas with current technology. Our hash verification tutorial under Insights takes the integrity verification step of this guide and shows how to record it.