1 PLANNING Mission and purpose The mission explains why an organization exists. It must detail, both to internal and external actors, what the organization does and for whom and what values drive it8. Normally, the mission does not include “how” it achieves its mission, since this can vary over time. The mission must be specific and clearly defined, since it should not change over time. Verbs are usually used in the infinitive and in the present. In the context of a National CSIRT, the purpose of the organization must be concrete, explicit and use clear terms.9 WHAT In describing what the team does, it is customary to use terms such as coordinate, promote regulation, lead efforts, protect, prevent, or articulate activities like incident response, cyber security, information systems or assets, etc. WHOM In describing for whom activities are performed, terms often used are country, state, government, sector, or others. VALUES Regarding the values that drive the mission, the motive must be clearly stated, for example by using terms like: development, wellbeing, safety, or risk management. Values such as security, trust or responsibility, among others can also be invoked. National Cyber Security and Communications Integration Center Mission | NCCIC, USA To reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the Nation’s critical information technology and communications networks. To execute its mission effectively, the NCCIC will focus on three core strategic priorities and associated operational objectives. The NCCIC will implement this strategy by expanding and attaining the capabilities, products, and services required to meet each of its strategic priorities over the next five years. Many of these activities will be coordinated, developed, and executed collaboratively with the NCCIC’s operational partners to the benefit of the entire community of cyber and communications stakeholders. It can be noted that each of the missions clearly states the CSIRT’s main objective and whom it will serve. Later, this mission statement will be used as reference to express the scope of the National CSIRT in detail. ColCERT Mission | Colombia Here are examples of some mission statements from CSIRTs around the Americas. 30 A B C D Establishment The Colombian Cyber Emergency Response Group, colCERT, has as its main responsibility coordination of National Cyber Security and National Cyber Defense, which will be framed within the Mission Process of Security and Defense Management of the Ministry of Defense. Its main purpose will be to coordinate the necessary actions for the protection of critical infrastructure of the Colombian state against cyber emergencies that threaten or compromise national security and defense. VenCERT Mission | Venezuela The mission assigned to VenCERT, which is to contribute to the general objective of the National Information Security System, is detailed in the following points: • Prevention, detection and management of incidents affecting State Information Systems and entities that manage the Critical Infrastructures of the Nation. • Main national point of coordination of other incident management centers in the country and abroad. • Provide advice, support and training on security issues to heads of ICT in government agencies or entities managing National Critical Infrastructure. • Coordination of public and private initiatives on ICT security in the State, carried out through R&D projects, training and awareness raising, development of standards, policies or guidelines, both for the benefit of the community (State and national CI operators) and for the improvement of services provided within VenCERT VenCERT stands, therefore, as the Venezuelan government CERT, whose main objective is the prevention, detection and management of incidents generated in information systems throughout the National Public Administration and Public Sectors in charge of the management of Critical Infrastructure in the nation. CERTuy Mission | Uruguay Protect critical information assets of the State and promote awareness in information security in order to prevent and respond to security incidents. 31