vPLfv

continue to not only define these processes in more detail but also to develop methods to
build, sustain, and evaluate the processes.
This report is not a “how to guide.” It is a vehicle to present the initial work we have done
toward the development of the “roadmap” previously discussed. Organizations looking for
assistance in building or improving incident management capabilities should look to our
other publications and available training as outlined at our main web site for CSIRT Development,
http://www.cert.org/csirts/.
Much of our initial work to date has been within the CSIRT community. This report, although
applicable to broader incident management processes, is written from a CSIRT perspective. It
approaches the process definitions from a CSIRT point of view, often addressing how CSIRTs
fit into the overall incident management framework in their parent organizations or constituencies
(hence the title of the report). However, many organizations do not have entities that
they call CSIRTs; they have some other organizational structure or processes to handle this
work. This report is still applicable to those organizations. It is useful outside of the CSIRT
community and can be applied in any organization that deals with the handling and prevention
of computer security incidents.
It should be pointed out, however, that the initial set of processes included here are more appropriate
for internal incident management or CSIRT capabilities, as defined in our report
Organizational Models for CSIRTs [Killcrece 03a]. An internal capability is one in which
staff in the organization have been assigned the responsibility for incident management and
the constituency being serviced is the parent organization. Future work will include applying
these processes to other organizational models, particularly the Coordinating CSIRT model.
The terminology and variety of organizational structures involved in incident management
today can often be confusing. We will begin to explore some of these areas of confusion in
the material presented here. We will look at the difference and relationship between CSIRTs
and incident management capabilities; we will also look at the difference and interrelationship
between incident management and security management functions.
The material in this report is based on the information we have collected through our own
experiences, discussions with and observations of other CSIRTs and incident management
organizations, research and review of existing publications and literature related to CSIRTs
and incident response, and from experience with risk analysis and process methodologies. We
are very interested in receiving comments about this work from the CSIRT community. If you
would like to share your opinions or suggest additions to this report, please contact us by
sending email to csirt-info@cert.org.
CMU/SEI-2004-TR-015
xi