vPLfv

Preface
Since its inception, the CERT ® Coordination Center (CERT/CC) has had a strong commitment
to transition lessons learned about computer security incident handling to the broader
Internet community. The ultimate goal of this transition work is the development of a community
equipped to recognize, prevent, and effectively respond to computer security risks
and threats against their organizations.
To accomplish this transition work, our basic strategy is to develop a body of knowledge that
will codify best practices for creating, managing, and sustaining incident management capabilities,
based on the 15+ years of experience of the CERT/CC and other national and international
teams. We then make this body of knowledge and resulting products available through
publications, training courses, collaboration, and direct assistance to organizations interested
in building or improving incident management capabilities.
Incident management capabilities 1 can take many forms—they can be an ad hoc group that is
pulled together in a crisis, they can be a defined set of procedures that are followed when an
incident occurs, or they can be a designated group of people assigned explicit responsibility
for handling computer security incidents, generically called a computer security incident response
team, or CSIRT. 2
In our work, we are often asked for a “roadmap” or set of processes and templates that can be
used by an organization to guide the development of their incident management capability.
Correspondingly, we are asked how best to evaluate and measure the success and quality of
an existing incident management capability. With these questions in mind and with an objective
to continue our work in not only codifying best practices for incident management but
also in building an overarching framework for our developing body of knowledge, we began
a project to outline a methodology for planning, implementing, improving, and evaluating an
incident management capability.
This methodology will identify key components for building consistent, reliable, and repeatable
incident management processes. It will include a set of requirements or criteria against
which an organization can benchmark its current incident management processes. The results
®
1
2
CERT and CERT Coordination Center are registered in the U.S. Patent and Trademark Office by
Carnegie Mellon University.
The definition of incident management services and capabilities will be explored in the rest of this
document.
The term “CSIRT” is a generic, common name for an organization that provides services to a defined
constituency to prevent and handle computer security incidents. Other synonymous names
are discussed in Section 2.4, “What’s in a Name?” of the handbook Organizational Models for
CSIRTs [Killcrece 03a].
CMU/SEI-2004-TR-015
ix