It should be pointed out, however, that the initial set of processes included here are more appropriate for internal incident management or CSIRT capabilities, as defined in our report Organizational Models for CSIRTs [Killcrece 03a]. An internal capability is one in which staff in the organization have been assigned the responsibility for incident management and the constituency being serviced is the parent organization. Future work will include applying these processes to other organizational models, particularly the Coordinating CSIRT model
