CSIRT maturity
An incident response team is more than skilled analysts. It needs a clear mandate, defined services, working processes and a place in the international community. I help you build that structure and get it recognised.
When it makes sense
- You are creating an internal CSIRT or a CSIRT for your sector, region or customers
- Your team exists but works without a defined mandate or service catalogue
- You want to be listed or accredited by TF-CSIRT (Trusted Introducer)
- You want to join FIRST, the global forum of incident response teams
- You want to measure your maturity against a recognised model
How I work
- 01
Maturity assessment
Where your team stands on mandate, organisation, tools and processes, measured against SIM3.
- 02
Mandate and services
Your constituency, authority and service catalogue, written down and agreed with management.
- 03
Processes
Incident handling, escalation, cooperation with other teams and information sharing, documented and usable.
- 04
Community
Preparing the TF-CSIRT application and the FIRST membership, including finding sponsors where needed.
- 05
Follow-up
Support until accreditation, and a roadmap to keep improving.
What you get
- A SIM3-based maturity assessment with a clear gap analysis
- A CSIRT description (mandate, constituency, services) in the expected format
- Documented core processes
- A roadmap and application support for TF-CSIRT and FIRST
Why Cyber Horizon
- Hands-on experience inside incident response teams, not just consulting
- Knowledge of the European and international CSIRT community
- GIAC Security Expert (GSE)
- Practical approach: processes your analysts will actually follow
Frequently asked questions
How long does accreditation take?
It depends on your starting point. Listing with TF-CSIRT is relatively quick; accreditation and certification take longer and require documented, working processes.
Do we need to be a large organisation?
No. Small and sector-specific teams are accredited too. What matters is a clear mandate and processes that work.
What is the difference between TF-CSIRT and FIRST?
TF-CSIRT is the European community of incident response teams and runs the Trusted Introducer listing and accreditation. FIRST is the global forum; membership requires sponsorship by existing members.
Can you also train the team?
Yes. Training in incident response, digital forensics and SOC analysis can be part of the programme.