FIRST Services Framework

The Services Frameworks are high level documents detailing possible services CSIRTs and PSIRTs may provide. They are developed by recognized experts from the FIRST community. FIRST strives to include feedback from all sectors, including CSIRTs with a national responsibility, private sector CSIRTs and PSIRTS as well as other stakeholders. These documents where intended to provide a foundation for the development of new training material.However today they are used in a much wider scope, e.g. when defining an initial service catalogue for new teams. These documents will be made available in English, Arabic, Chinese, French, Russian and Spanish.

In the creation of the CSIRT framework it became clear, that PSIRTs do provide quite different services and typically operate in quite different environments. It was thus decided to create a separate document covering PSIRTs. The two documents will be aligned highlighting the many similarities shared.

The development of the Frameworks is driven by the CSIRT Framework Development SIG.

Purpose

The Frameworks are to assist organizations in building, maintaining, and growing capabilities of their CSIRT or PSIRTs. The frameworks are a guide and identify various models, capabilities, services and outcomes. In this way, teams are free to implement their own model and to build capabilities that meet their Stakeholder’s unique needs. The Frameworks seek to assist SIRTs by identifying core responsibilities, providing guidance on how to build capabilities to meet those responsibilities and offering insights on how SIRT teams can add and communicate value to their larger organizations.

Status

• Currently the CSIRT Services Framework (PDF) is available at version 2.1.
• The addendum to it about CSIRT Roles and Competencies (PDF) is available at version 0.9 for review.
• The PSIRT Services Framework (PDF) at version 1.0.
• The document about Team Types within the context of Security Incident Management has been updated to version 1.1: PDF.

• Standards & Publications
  • Standards
    • Common Vulnerability Scoring System (CVSS-SIG)
    • Traffic Light Protocol (TLP)
      • TLP Use Cases
    • Service Frameworks
      • CSIRT Services Framework
      • PSIRT Services Framework
    • Information Exchange Policy (IEP)
      • IEP 2.0 Framework
      • IEP 2.0 JSON Specification
      • Standard IEP Policies
        • IEP TLP Policy File
        • IEP Unknown Policy File
      • IEP 1.0 Archive
    • Passive DNS Exchange
    • Exploit Prediction Scoring System (EPSS)
  • Publications