CERT community : recognition mechanisms and schemes

This document provides an overview of existing mechanisms supporting Computer Emergency Response Teams (CERTs) to deploy capabilities necessary for their operations and their maturity level. It introduces these mechanisms according to the CERT maturity levels that they address based on eight predefined criteria including requirements that CERTs must meet; CERTs' focus: type or region; and definitions and terminology used. A three-tier CERT maturity model was specifically developed for the purpose of this project, with the tiers being three respective stages of a CERT development: fundamental, baseline and advanced. At each stage of this progression, mechanisms from CERT community organisations provide guidance and support to CERTs with regard to the defined categories. For all three tiers the document highlights important commonalities and differences among the mechanisms. This enables the identification of potential areas for harmonisation of the CERT mechanisms, though this document does not aspire to determine how, when or by whom the harmonisation efforts should be carried out. As partly confirmed by direct consultations with them while preparing this paper, CERTs are in need of harmonisation for the following reasons: -Requirements and validation process: CERTs need to meet and adhere to different requirements, which is resource- and time-intensive. This would be much more effective and easier based on harmonisation across the CERT community. - Definitions and terminology: Many terms and definitions used by CERT organisations are already similar. Harmonising core terms such as CERT (CSIRT), constituency, or incident would make these mechanisms significantly more compatible and make it easier for CERTs to subscribe to, or utilise, various mechanisms. - CERT types (sectors): It could be beneficial for different mechanisms to harmonise their definitions of sectors that vertical-specific CERTs typically focus on, and to specify clearly various constituency types, as doing so would offer more clarity and transparency surrounding CERT activities. - Training: Harmonisation could lead to synergies, proliferation of training opportunities for CERTs, and more opportunities for CERTs to meet and share good practices. Good progress has already taken place in this respect with several CERT organisations including ENISA and FIRST supporting TERENA's TRANSITS training for CERTs, and ENISA producing material that actively is rolled out to CERTs on request.