Workflows

We have taken the following steps so far:
Understanding what a CSIRT is and what benefits it might provide. 
To what sector will the new team deliver its services to? 
What kinds of services a CSIRT can provide to its constituency. 
Analysis of the environment and constituents. 
Defining the mission statement. 
Developing the Business Plan.
a. Defining the financial model. 
b. Defining the organisational structure. 
c. Starting to hire staff. 
d. Utilising and equipping the office. 
e. Developing an Information security policy 
f. Looking for cooperation partners. 
Promoting the Business Plan.
a. Have the business case approved. 
b. Fit everything into a project plan. 


>> The next step is: making the CSIRT operational

Having well defined workflows in place will improve the quality and the needed time per incident or vulnerability case.

As described in the example boxes, Fictitious CSIRT will offer the basic CSIRT coreservices:

• Alerts and Warnings
• Incident Handling
• Announcements

This section provides examples of workflows that describe the core-services of a CSIRT.

This section also contains information about collecting information from different sources, checking it on relevance and authenticity and redistributing it to the constituency. And finally this section contains examples of the most basic procedures and specific CSIRT tooling.