This report is not a “how to guide.” It is a vehicle to present the initial work we have done toward the development of the “roadmap” previously discussed. Organizations looking for assistance in building or improving incident management capabilities should look to our other publications and available training as outlined at our main web site for CSIRT Development, . Much of our initial work to date has been within the CSIRT community. This report, although applicable to broader incident management processes, is written from a CSIRT perspective. It approaches the process definitions from a CSIRT point of view, often addressing how CSIRTs fit into the overall incident management.
