CSIRT Framework Development SIG
Mission
The state-of-the-art for CSIRTs could still improve considerably by extending and improving the available set of foundational frameworks and materials. The SIG will seek to involve experts interested in that work and provide a community to discuss improvements in need, existing gaps and (potential) new developments – taking into account, and collaborating where appropriate, initiatives from within FIRST and other entities/communities aiming for similar objectives (like APCERT, ENISA, GFCE, ITU, LACNIC, OCF, OAS, TF-CSIRT, etc.).
By identifying needed materials which are not readily available from other entities, the SIG will discuss needs and gaps and decide on the way forward either by:
- Bringing in a resource for improvement work after agreement by the original authors and/or copyright owners (preferably get them on board);
- Analyzing in more detail how to fill identified gaps/issues;
- Identifying the need for a more widely consolidated effort, requiring extra means or a wider audience, and taking this up within FIRST;
- Monitoring the take-up of identified gaps and issues by other entities and communities and coordinate liaisonships with such efforts;
- Taking up the (re-)drafting and publication of the CSIRT services framework should the need arise.
Goals & Deliverables
Until June 2025, the SIG aims to:
- Produce the v1.0 of the addendum "CSIRT Roles and Competencies" based on the review of the CSIRT community;
- Provide a slide deck "Basic Security Incident Management Team Types" until December 2024
- Produce an updated extension of the document "Team Types within the context of Security Incident Management Services Frameworks" containing commonly recognized sub-types (like "coordinating CSIRT") of the four basic team types;
- Work on an updated version of the CSIRT Services Framework to be
compliant to the identified four basic team types and applicable sub-types;
- Foster liaisonships with other communities/organizations supporting CSIRT capacity/capability/maturity initiatives to improve the adoption of the CSIRT Services Framework v2.1 and the new addendum as well as the defined team types (at least: APCERT, ENISA, GFCE, ITU, LACNIC, OCF, OAS, TF-CSIRT);
Chair
Request to Join
