v1.2.0 · Open source, CC BY 4.0 · Built for the EU
Build and mature your cyber defence
A free framework for the people who detect and respond to cyber attacks in European organisations. That might be a 24/7 Cyber Defence Center, or two people in IT who also look after security. The standards describe what good security covers, and NIS2 says what you are obliged to do. Neither tells you how to set up and run the team that does the work. That is what this framework is for. Is this for me?
- No account
- Tools run in your browser
- Plain documents you own
6CSF functions
4Maturity levels
27National annexes
3Browser tools
Is this for me?
Probably, if part of your job is noticing attacks and dealing with them. The framework calls that work a CDC, whatever your team is called and however small it is. Every capability is marked with the smallest tier it belongs to, so a team of two can see what matters now and what can wait.
-
A small IT-security team
One to three people, and security is only part of the job. Start with what to buy rather than build, and the four things nobody can do for you.
-
CISO or executive
Thirty minutes on what a CDC is for, what NIS2 expects of management, what it costs, and what to ask the people running it.
-
Building a SOC or CDC
You have a mandate and a budget, or soon will. Seven steps take you from a signed charter to a team with a working routine.
-
Running one already
Score what you have against the maturity criteria, reusing any SOC-CMM, SIM3 or CIS assessment, and turn the gaps into a plan.
-
Analyst or engineer
The daily work: triage, detection-as-code, threat intelligence and the playbook templates.
-
Compliance or legal
Which of NIS2, GDPR, DORA, CRA and CER apply to you, what they ask of a CDC, and the national rules in all 27 member states.
The framework in one picture
Every capability in OCDF is described in three ways:
What6 functionsCover all six
How muchE · S · A tierYou choose
How wellL1–L4 maturityScored against set criteria
↺ Lessons learned in RECOVER feed the next round of IDENTIFY
Each capability is also read through the CIA triad and the regulatory layer: NIS2, GDPR, DORA, CRA, CER and the national rules of all 27 member states. People and process come before technology in every build sequence.
Every function page has the same parts: capabilities with IDs like DE-2,
maturity criteria, the EU rules that apply, and the other departments it
depends on. Reaching Level 2 in every function also covers what NIS2 requires,
as the NIS2 Article 21 crosswalk shows. If
the terms are new, OCDF on one page explains them in five
minutes.
Start building
Seven steps, from deciding how much of the framework you need to the routine that keeps the work going. Each one leaves you with a document you keep: a signed charter, a scored baseline, a plan with names and dates on it. They go into your own document system and governance process, and none of them depends on this website.
Design
- Choose your tier. Essential, Standard or Advanced decides how much of the framework applies to you. Implementation tiers Output: target tier
- Run the design workshops. Six workshops, one per function, surface your gaps and the decisions nobody has taken yet. Design navigator Output: design gaps logged as backlog items
- Adopt the charter. Mandate, scope and containment authority, signed before anything is bought. CDC charter Output: signed charter
- Decide the operating model. In-house, provider or hybrid, with the staffing arithmetic and a cost template. Operating models Output: target operating model and staffing numbers
Build
- Assess where you are. Score the maturity criteria and give every gap an owner and a due date. Maturity self-assessment Output: scored baseline with evidence, and an action plan with owners
- Work the first 90 days. The order of work, week by week, with exit criteria. Start here Output: day-90 exit criteria met
Run
- Set the operating rhythm. The recurring work that keeps a CDC from decaying, and a detection portfolio that grows from your threat profile. Annual calendar · Detection use case Output: annual calendar and a growing detection portfolio
See it worked through
Exempla Parcel is invented, but its starting point is common: 2,500 employees, sorting that runs all night, four people in IT security and no SOC. The worked example takes it through the seven steps, from the tier decision to its first board report.
- 2,500 employees
- 14 sites, night operations
- NIS2 important entity
- Standard tier
- Hybrid operating model
Before
- Security spread across four people, with no shared plan
- No agreement on who may contain what
- Alerts looked at when someone had time
- Nobody named for NIS2 reporting
After
- A signed charter with containment authority
- A daytime team, and a provider for nights
- A scored baseline and a 90-day plan
- Maturity targets agreed with the board
Maturity after 12 weeks Level now Target
The templates are plain documents to copy and change. The three browser tools run entirely in your browser, and nothing you type into them is sent anywhere. Everything is on GitHub under CC BY 4.0, or as a zip download.