vPLfv

and service offerings. It can also be used to help gather management buy-in and support and,
after support has been obtained, to strategically plan and develop a capability.
Use the Handbook for CSIRTs for specific in-depth guidance for issues relating to the establishment
and operation of a CSIRT. Use Organizational Models for CSIRTs to understand the
specific issues to be addressed when determining the model for your CSIRT. Use the State of
the Practice of CSIRTs report for the historical background on the development of CSIRTs,
for examples of what other teams are doing, and as a reference to existing articles, publications,
books, laws, and training related to CSIRTs and incident management. Use the Defining
Incident Management Processes for CSIRTs report to provide an overview of the processes
and functions and supporting people, technology, and procedures that are involved in
incident management.
Other SEI publications that this report may be used in conjunction with include some Security
Improvement Modules available from the CERT/CC web site, 11 including
• Responding to Intrusions
http://www.cert.org/security-improvement/modules/m06.html
• Detecting Signs of Intrusion
http://www.cert.org/security-improvement/modules/m09.html
• Outsourcing Managed Security Services
http://www.cert.org/security-improvement/modules/omss/index.html
1.9 Structure of the Report
The remainder of this report will detail our progress to date in developing incident management
process maps for CSIRTs.
Section 2, “Incident Management Concepts and Processes,” will expand on the ideas and
concepts of the five top-level incident management processes. This discussion will include a
rationale for including the processes we did, a discussion of incident management as it relates
to the domain of security management, and an example of how we see this work being used
in an organization.
Section 3, “Overview of Process Mapping,” will provide an explanation of what process
mapping is and how it can be applied to incident management. This section also contains a
description of the data elements or components of the process workflows and descriptions,
along with a legend for reading and understanding the process workflow diagram symbols
and drawings.
Section 4, “Incident Management Process Workflows and Descriptions,” contains the main
content of this report. This section includes the process workflow diagrams and supporting
descriptions in the form of process data and handoff templates. Preceding each workflow will
11
Available at http://www.cert.org/security-improvement/#modules.
CMU/SEI-2004-TR-015 13