vPLfv

Abstract
This report presents a prototype best practice model for performing incident management
processes and functions. It defines the model through five high-level incident management
processes: Prepare/Sustain/Improve, Protect Infrastructure, Detect Events, Triage Events, and
Respond. Workflow diagrams and descriptions are provided for each of these processes.
One advantage of the model is that it enables examination of incident management processes
that cross organizational boundaries, both internally and externally. This can help computer
security incident response teams (CSIRTs) improve their ability to collaborate with other
business units and other organizations when responding to incidents.
Future reports will extend this work and provide additional guidance to enable both newly
forming and existing incident management capabilities to use the model to determine where
gaps exist in their current processes and to develop plans for creating, improving, or restructuring
their incident management processes.
Although the processes defined in this document were originally developed for internal
CSIRTs, the models and information presented here are applicable to other types of CSIRTs
and other types of incident management and security management capabilities.
CMU/SEI-2004-TR-015
xv