Written for NIS2, DORA and GDPR · All 27 EU member states
Build and mature your cyber defence
Standards say what security must cover, and NIS2 says who is accountable. Neither shows how to build and run the team that detects and responds to attacks. This framework shows how, whether you are two people in IT or a large enterprise with a 24/7 SOC.
- Free to use and adapt, also commercially
- No account; tools run in your browser
- Vendor-neutral
Is this for me?
Yes, if part of your job is noticing attacks and dealing with them, whatever your team is called. Every capability is marked with the smallest tier it belongs to, so a team of two sees what matters now.
-
A small IT-security team
One to three people with other duties. What to buy rather than build, and the four things nobody can do for you.
-
CISO or executive
Thirty minutes on what a CDC is for, what NIS2 expects of management, and what it costs.
-
Building a SOC or CDC
Seven steps from a signed charter to a team with a working routine.
-
Running one already
Score what you have, reusing any SOC-CMM, SIM3 or CIS assessment, and turn the gaps into a plan.
-
Analyst or engineer
The daily work: triage, detection-as-code, threat intelligence and the playbook templates.
-
Compliance or legal
Which EU laws apply to you, what they ask of a CDC, and the national rules in all 27 member states.
The framework in one picture
Every capability in OCDF is described in three ways:
What6 functionsCover all six
How muchE · S · A tierYou choose
How wellL1–L4 maturityScored against set criteria
↺ Lessons learned in RECOVER feed the next round of IDENTIFY
Each capability is also read through the CIA triad and the regulatory layer. Level 2 in every function covers what NIS2 requires, as the NIS2 Article 21 crosswalk shows.
Start building
Each step leaves you with a document you keep: a signed charter, a scored baseline, a plan with names and dates.
Design
- Choose your tier: how much of the framework applies to you.
- Run the design workshops: one per function, to find the gaps.
- Adopt the charter: mandate and containment authority, signed first.
- Decide the operating model: in-house, provider or hybrid, with the staffing numbers.
Build
- Work the first 90 days: steps 2 to 4 are its first weeks.
- Assess where you are: at day 90, with an owner and a date on every gap.
Run
- Set the operating rhythm: the recurring work that keeps a CDC from decaying.
See it worked through
An invented company with a common starting point: four people in IT security, no SOC, and operations that run all night. The worked example takes it through the seven steps to its first board report.
- 2,500 employees
- 14 sites, night operations
- NIS2 important entity
- Standard tier
- Hybrid operating model
Before
- Security spread across four people, with no shared plan
- No agreement on who may contain what
- Alerts looked at when someone had time
- Nobody named for NIS2 reporting
After
- A signed charter with containment authority
- A daytime team, and a provider for nights
- A scored baseline and a 90-day plan
- Maturity targets agreed with the board
Maturity after 12 weeks Level now Target