NIST workshop report on 'SI' incident management lists SP 800-61 update among areas for future work
Internal Report 8621, drawn from a May workshop of more than 400 participants, lists evidence collection, information sharing and clarifying responsibilities across developers, deployers and users as future work.
NIST has published Internal Report (IR) 8621, summarising findings from a workshop held on 14 May 2026 with more than 400 participants from government, industry, academia and other communities. It examines the management of what NIST calls ‘super intelligence (SI)’ incidents, described by CDO Magazine as incidents involving AI systems. These cover both cyberattacks on such systems and harms from misuse, malfunction or unintended actions.
The report reviews current practice, existing guidance, preparedness gaps and the roles of the organisations involved. Areas for future work include updating NIST’s incident response guidance, including SP 800-61, exploring new readiness resources for model developers, monitoring and evidence collection, incident information sharing, and clarifying coordination between developers, deployers and users.
According to CDO Magazine, the report suggests life cycles designed for conventional software may be incomplete for probabilistic, autonomous systems. It does not set a mandatory standard; NIST says it will inform further stakeholder engagement.
Why it matters
According to CDO Magazine, SP 800-61 addresses cybersecurity incidents but AI systems bring added challenges, and when an AI system produces an unintended outcome organisations need to establish what it accessed, which actions it took and how those actions were authorised. Teams should check whether AI deployments log data sources, actions and permissions in a form usable as incident evidence, and whether contracts with model providers and service vendors assign coordination and investigation responsibilities. Watching NIST's work on SP 800-61, listed as a key area for future work, will help align AI governance with existing security incident processes.
Status: Published. Non-binding workshop report; no new mandatory standard
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- AI governance lead
- CISO
- CDO
- Legal & compliance