New and Improved? CSIRT Maturity Framework from ENISA

Editor’s Note: According to the announcement published on February 23, 2022, the new version of the maturity framework builds upon the existing maturity framework developed in 2019 by the European Union Agency for Cybersecurity, ENISA, for the Cybersecurity Incident Response Teams (CSIRTs).

The CSIRT maturity framework is used by the CSIRTs Network members to understand, maintain and improve their maturity. The framework is intended to contribute to the enhancement of cyber incident management capacity, with a focus on national CSIRTs.

CSIRTs can therefore assess the level of their maturity thanks to the tailored assessment methodology developed by ENISA.

Report

ENISA CSIRT Maturity Framework

Introduction Extract

This document presents ENISA’s Computer Security Incident Response Teams (CSIRT) Maturity Framework that is intended to contribute to the enhancement of the capacity to manage cyber incidents, with a focus on national CSIRTs. It is aimed at parties involved in planning, building, and leading such capacities. This document has been developed as part of ENISA’s continuous commitment to enhancing CSIRTs and related methodologies.

National CSIRTs play a crucial role in the collaboration and coordination between national and international communities and organizations. Cyber incidents and developments are inherently transnational and effective responses depend on transnational collaboration. The establishment of national CSIRTs is an essential step to facilitate and coordinate the building of cyber capacity both within and across nations.

Within the CSIRT community, incident management is generally defined as the combination of incident prevention, detection, resolution, and quality management – thus much more than just incident handling. As such, CSIRTs form an essential element of cyber incident management and cyber capacity in general.

Internal CSIRTs (sometimes also referred to as ‘enterprise’ CSIRTs) operate at the level of individual organizations – this can be any type of organization, such as a private company, multinational, not-for-profit, university, hospital, or government agency. Such internal teams have a clear mandate and knowledge to perform hands-on incident management activities within an organization’s network of IT systems.

Another type of CSIRT has an external focus and provides services to a sector or nation, and usually has a limited mandate to access or implement security measures within the actual IT systems of their constituency. Therefore, these focus more on the coordination of responses, the analysis of threats and incidents, and other forms of support to members within the constituency.

National CSIRTs are in the latter category. They generally provide the capability of rapid, integrated, and coordinated responses to cyber incidents for national sectors, cyber-dependent communities such as e-commerce enterprises or financial institutions, critical infrastructure, and the nation at large, as well as being important links in the global CSIRT community. Depending on the specific legal and political context, national CSIRTs can have a variety of focus areas and mandates. In some nations, national CSIRTs are institutionally embedded in (or closely related to) a National Cyber Security Centre (NCSC) or similar authority or agency.

NCSCs have a broader mandate as national coordination centers: they provide technical and policy expertise and are usually tasked with executing national crisis exercises and contributing to technical standards and legislation. In some countries, national CSIRT functions are distributed between two or more teams. In cases of multiple national teams, it is important that the mandate and constituencies for each team are clearly defined and that they can co-operate closely.

Encouraging the establishment, expansion, and maturity of national CSIRTs contributes to the ambition of building European and global cyber capacity, supplementing the existing network of private industry and academic and research CSIRTs. To do so, it is important to approach the development of this network from both a technical as well as a policy perspective. Existing models and good practices for CSIRTs and CSIRT maturity can not only support nations that are ready to establish a national CSIRT but also nations that want to enhance the maturity of their national team.

The new version of the ENISA CSIRT Maturity Framework presented here includes the OCF SIM3 standard, with its more-than-forty parameters; the ENISA three-tier approach, which consists of three pre-defined maturity steps (Basic, Intermediate, and Advanced) that can be used as stepping stones towards increased maturity; and an enhanced ENISA assessment methodology, based on a system of self-assessments and peer-reviews with elaborate guidance on best practice. A main thread in all this is to give guidance on how to work with the Maturity Framework with teams at different phases, from pre-establishment through the whole maturity cycle to the advanced stage.

It is important to recognize that the framework is not intended to be prescriptive but is meant to support and stimulate national efforts on building global capacity for responding to cyber incidents. However, the maturity steps that have been defined are based on extensive experience and expertise in the CSIRT community and offer valuable guidance for national CSIRTs regarding the quality level to which they aspire. It needs to be stressed here that the NIS Directive has been taken right from the start as the inspiration and guide for the steps towards maturity, and this is reflected in the ENISA three-tier approach – and with the changes in the NIS Directive, it became necessary to further upgrade the Basic, Intermediate and Advanced steps.

The ENISA CSIRT Maturity Framework builds on its previous incarnation and continues to adopt the Open CSIRT Foundation’s SIM3 standard, whilst applying improvements and updates across the board.

Read the original announcement.