1 PLANNING As the response team matures, it will likely create new areas and functions. Among possible new areas are: With additional services, the CSIRT’s flowchart would be: Management Audit Laboratory Security Operations Center Information Security Management Systems This area, which can fall under management or R&D, will conduct forensic activities and/or malware analysis and provide research services to other areas. If the service roadmap indicates having a security operations center, a SOC area can be created, which can depend directly on management or operations. If the aim is to establish support services for the implementation of ISMS, a specific area may be established for that. Training If the CSIRT and its target community have sufficient requests for training, a dedicated training department can be established. As the team size grows, it may eventually have to incorporate an auditing department to verify whether policies and procedures at the CSIRT are followed in accordance with the level desired by the target community. Operations IT R&D SOC Development Incident Response Labs (Malware, Forensics) Training Information Security Management Support Services 54 A B C D Organization and HR 55