vPLfv

The scope of this report is the draft set of process flows that exist at the time of this report’s
publication. Future publications will document the final version of this work and all the corresponding
subprocess mappings.
It must also be pointed out that in documenting the processes we focused on what were considered
common best practices. We did not include exceptions or customized approaches or
processes. Our intent is to provide this best practice set of materials to organizations in a way
that they can modify or adapt to fit any specific needs, requirements, or considerations they
may have.
The majority of the discussion throughout the rest of the report will be primarily geared to
organizations in the commercial, educational, military, or government areas where an internal
CSIRT model would be most appropriate. Not all of the processes detailed here may be applicable
to other CSIRT models, particularly coordinating CSIRTs. However, many of the
processes will indeed be appropriate. Future work may take a separate look at the set of processes
for performing incident management activities in a coordinating CSIRT.
1.7 Intended Audience
The primary audience for this report is individuals tasked with creating, operating, benchmarking,
or evaluating a CSIRT or incident management capability, including
• CSIRT development project team members
• CSIRT managers
• CSIRT staff
• internal, external, and third-party evaluators
• MSSPs
• regional or national initiatives seeking to build CSIRTs or incident management capabilities
• incident handling communities such as the Forum for Incident Response and Security
Teams (FIRST)
Although the processes here are more aligned with functions performed by an internal
CSIRT, the concepts, ideas, and framework defined will be applicable and of interest to all
types of CSIRTs and incident management capabilities.
This report will also be of benefit to others who may want to gain a better understanding of
incident management and CSIRT processes, functions, and interactions, including
• chief information officers (CIOs)
• chief security officers (CSOs)
• other C-level managers such as chief financial officers (CFOs) and chief risk officers
(CROs)
• business function managers
CMU/SEI-2004-TR-015 11