Skip to content

Changelog — Open CDC Framework

Unreleased

  • Checked end to end. Every internal link and heading anchor, on the website and as GitHub resolves them; every external link; the three browser tools at desktop and phone width; and every page for overflow, broken images and rendering. What the check found and fixed:
    • Content: the skill self-assessment has 47 skills, not 50; references to the old numbered file names, such as 13-cdc-operations, are replaced by links in the CSIRT community layer, the annual calendar, the controls register and the metrics template; the CSIRT community layer links to the closure taxonomy in RESPOND instead of repeating it; ABOUT no longer promises an OT profile and points to the IT/OT interface instead of repeating it; the worked example's board report names all three functions below the floor.
    • Annexes: every annex except Denmark's, which was reviewed in September, is re-checked as of October 2026 against authority sites and secondary sources, with the next review due in April 2027. Cyprus, Estonia, Poland and Portugal now show as in force, with act numbers and dates. Cyprus sets stricter clocks than the directive, an early warning within 6 hours and a final report within 15 days of restoration; this is in its annex, in RESPOND and as a reporting row in the regulatory selector. Ireland, France and Spain stay pending: Ireland's bill is still unpublished, France's was taken off the Assemblée nationale agenda on 6 October 2026, and Spain's lapsed when the Cortes were dissolved on 5 October 2026. Bulgaria's amendment entered into force on 17 February 2026, not on publication; Croatia's CSIRTs are those at SOA and CARNET; Czechia, Romania, Slovenia, Slovakia, Lithuania, Latvia, Belgium and Finland gain act numbers, approval laws or registration deadlines; Germany's note records that the BSI's tolerance for late registration ended on 31 July 2026. Sweden names MCF, which replaced MSB in January 2026, and CERT-SE at the National Cyber Security Centre at FRA since July 2026, with the Cybersecurity Act (2025:1506) in force from 15 January 2026. Malta cites S.L. 460.41, Legal Notice 71 of 2025 as amended by Legal Notice 89 of 2026, with the CIP Department as authority and its confidence lowered to needs verification. Luxembourg's NIS2 law of 5 May 2026 has been in force since 10 May 2026; the annex no longer calls it pending. Slovenia's authority link was dead and is replaced, and Greece and Latvia now link to the authority's own pages.
    • Readability: bold is kept for run-in labels, form fields, warnings and interface names, and removed from 84 places where it only stressed words in running prose; headings no longer use a dash to add a subtitle; the CIA tables list capabilities in ID order; the roles sections no longer claim staffing figures they do not contain; the AI scale no longer lists a must rating that no use carried.
    • Diagrams: the first 90 days in Start here, the IT/OT boundary and who decides containment, and the AI uses by team size. The 90-day table is folded under its chart, and the AI table now carries only the conditions.
    • README: the plainer rewrite meant for v1.2.0 was overwritten by an older copy when the version was bumped, and is now in place: Why this framework exists, New readers and Is this for me? are rewritten and merged, with the same six entry points as the website, and the document tables move below the seven steps.
    • GitHub: the templates overview moved from the website-only site/templates-index.md to templates/README.md, so the link to it also works on GitHub, and its stale reference to an edit button is gone.

v1.2.0 — 2026-10-11

A review release. It changes the maturity criteria, so read Scoring changes below before comparing an assessment with one made under v1.1.0 or earlier. It also adds the IT/OT interface, alert triage and AI in the CDC, rebuilds incident handling on DAIR, and brings the first diagrams.

  • Nested lists fixed. Sub-lists indented by two or three spaces were flattened on the website, so the authorities and the energy-sector requirements in the Danish annex showed up as extra numbered items. Five pages are corrected, and tools/check_consistency.py now fails the build on a nested list indented less than four spaces.
  • Landing page rewritten in plainer language and tightened. What you get repeated the outputs already listed under Start building, and Is this for me? repeated the role cards below it. Both pairs are merged: Is this for me? now leads straight into six role cards, adding one for teams that already run a SOC or CDC, and Start building says what each step leaves you with. The lead, the worked-example summary and the footer are rewritten in plainer sentences, without dashes or brackets.
  • First diagrams. Four pages carried their main idea only as text and tables. RESPOND's How an incident moves is now a diagram of the gate, the response loop and the exit; the tier map shows all 43 capabilities by function and tier, with the NIS2 floor marked; the operating-model decision path and the 24/7 staffing arithmetic are drawn; and RESPOND shows the NIS2, GDPR, DORA and CER reporting clocks on one timeline. The tables behind the tier map, the five questions and the seat-by-seat line are kept, folded under the diagram. Diagrams are generated by tools/build_diagrams.py as a light and a dark SVG each, without web fonts or scripts, so they look the same on GitHub and on the website and follow either one's colour mode.
  • Dependency markers as badges. On the website, [GATE], [HARD] and [SOFT] in the external dependency tables and elsewhere now show as coloured badges with their meaning on hover. The documents are unchanged, so GitHub still shows the bracketed text.
  • New: Designing alert triage. DE-3 asked for a documented triage process but not for the decisions behind it. The new document covers five: who may close, defer and declare, including that declaring an incident never needs permission; a minimum triage record of eight questions that applies to human and automated triage alike; one set of outcomes, mapping RESPOND's continue, stop and defer onto the closure taxonomy; which questions to automate and which to keep with the analyst; and how triage quality is checked. It ends with a fill-in triage record. Linked from DE-3, RESPOND's verify-and-triage section and the scenario playbook template.
  • One closure vocabulary. Running the CDC listed its own dispositions, TP, FP-tunable, FP-accepted and benign-true-positive, beside RESPOND's closure taxonomy. The tuning loop now uses the closure taxonomy, with a reason on every false positive: rule defect or benign activity.

  • New: AI in the CDC. AI was covered only as guardrails on triage. The new document covers AI as the team's tool, as the adversary's tool, and as systems to protect, with a table of uses rated must, should, can, with caution or avoid for teams of one to three people, dedicated CDCs and large CDCs. It adds what every team must have, what to avoid, and the AI Act as amended by the Digital Omnibus on AI, including the open question whether employee behaviour analytics is high-risk under Annex III. The EU regulatory landscape gains an AI Act section. No maturity criteria change.

  • Open to small teams by name. The README and the landing page now say who the framework is for in their first lines: anyone responsible for detecting and responding to cyber attacks, whether the team is called a SOC, a CDC, IT security, or is two people in IT. A new Is this for me? section gives three entry points by team size, with the one-to-three-person path starting at if you are the whole security function, and the landing page gains a card for small IT-security teams. The introduction, one-page summary and executive guide state that CDC names the function, not the department or its size.

  • Incident handling follows a loop, not a line. RESPOND gains How an incident moves, adapted from Joshua Wright's Dynamic Approach to Incident Response, DAIR. It adds a verify-and-triage gate with three outcomes, an explicit scoping step, a response loop of scope, contain, eradicate and recover with named triggers for another pass, a written and named decision to leave the loop, and root cause analysis in two tracks. Where the book reflects US practice, OCDF adjusts it: the NIS2 and GDPR clocks run from awareness, so an investigative state does not hold them; severity and regulatory significance are kept apart with different owners; observing an adversary instead of containing needs legal and management sign-off when personal data or an essential service is at risk; and the long investigation is planned against the NIS2 one-month final report. RESPOND also notes that forensics on employee data needs a lawful basis settled in advance.
  • Templates follow the loop. The IR plan template's process section is rewritten around verify and triage, the response loop, the exit decision and the debrief, and §2 gains a decision authority table. The scenario playbook template gains a verification outcome, a scoping section, root cause questions and an iterate-or-exit step, and closes with a debrief that removes temporary actions. The containment catalogue says who may order each action, by impact rather than seniority, and requires temporary actions to be removed or made permanent at debrief. The plan's exercise schedule now asks for one exercise a year that tests decisions under time pressure, not only steps.
  • Recovery, metrics and AI. RC-3 adds the service owner's acceptance and a period of enhanced monitoring before a system counts as recovered; RC-5 starts with closing the incident properly. The metrics template reports MTTC as median and 90th percentile with external waits paused, and adds a response quality score and a reopened-cases rate. The AI guardrails in Running the CDC now require a record of AI-assisted findings and treat the choice of AI platform as a GDPR decision.

  • CSF mapping of incident handling stated precisely. The CSF crosswalk explains where OCDF departs from the book's own CSF mapping: CSF 2.0 places triage and validation in RS.MA and improvement in ID.IM, not in DETECT and RECOVER. It also states that the CSF is voluntary in the EU and points to the NIS2 crosswalk for what binds.

  • New: the IT/OT interface. OCDF stays scoped to IT, but the law does not split IT from OT, and in the Danish energy sector the preparedness act applies to the whole entity. The new document defines what the CDC owns at the boundary: the conduit register, boundary log sources and detections, escalation in both directions, containment actions with their decision owners, and one reporting owner across the boundary. A table shows which BEK 260 requirements OCDF covers and which remain with OT operations. Linked from the scope line, ABOUT, the introduction and the Danish annex.

  • Playbooks replaced by templates. OCDF no longer ships ready-made playbooks. The three attack drafts and four platform playbooks are removed and replaced by two fill-in templates: a scenario playbook and a platform response and forensics playbook, with the Microsoft and CISA baselines and the adaptation checklist moved into the scenario template. RS-2, the IR plan template, the navigator and the landing page now point to the templates, and the old playbook addresses redirect to them.
  • Roadmap removed. ROADMAP.md and its menu entry are gone, and pages no longer promise future profiles or playbooks; they say what OCDF covers today. The old /ROADMAP/ address redirects to About. Past changelog entries that mention the roadmap are left as history.
  • Tools tested end to end and fixed. All three tools were run with test data: filled sheets, broken files, old and damaged resume links, prints and phone-sized screens.
    • Team skill matrix: CSV files saved by Danish, German and other comma-decimal Excel, with semicolons and often Windows-1252, are read instead of rejected. Removing all data, a person or the edited role targets now asks first. A person with a role that has no targets is flagged on upload, and their role can be changed under People & data. The action cards say how many items are hidden, spread mentor pairings across coaches instead of giving every learner to the first, and no longer say "no basis to grow from" when someone has a basic level. The people table no longer makes the page scroll sideways on a phone. Wording is plainer throughout.
    • Maturity self-assessment: the tool no longer writes the resume link into the address bar while you work, so a bookmark always opens this browser's answers and old links stop causing false "two versions" prompts; a link is read once and then removed from the address bar. The printout now starts with the assessors, date, evidence location, target profile and scoring mode, followed by the results, with the score bars in colour. The benchmark contribution check counts 71 criteria, not 60. A damaged link gives a readable message. Target profiles are labelled GV ID PR DE RS RC instead of an ambiguous R R. The evidence field keeps its width on a phone.
    • Regulatory profile selector: the printout lists the selected instruments, countries and acts with the date, and leaves out the on-screen instructions. Annexes, references and the IR plan template are real links. The counter separates EU instruments, countries and national acts. Developer notes addressed to contributors are gone from the page.

This release changes the maturity criteria; read Scoring changes below before comparing an assessment with one made under v1.1.0 or earlier. It comes from a full devil's-advocate review of the framework, and fixes what that review found wrong, contradictory or missing.

  • Regulatory profile selector: national acts nest under their country. The Danish acts no longer sit in a fixed "Denmark — detailed acts" section that every visitor saw, whatever their country. They now appear underneath the Denmark checkbox when it is ticked, and are cleared when it is unticked, so a Finnish or German user sees the same EU instruments plus their own country and nothing Danish. Each country in the list says how many acts are mapped, and country cards without per-act detail say so.
  • National detail is now data, not HTML. Per-act checkboxes, national reporting rows and national hooks per framework function are all generated from the country's entry in docs/annexes/countries.json, through the fields acts, reporting, hooks and note. Bringing another country to Denmark's depth means editing one data entry, without touching the page layout; tools/README.md shows the format. Denmark also gains its fifth act, dk-fin (Lov om finansiel virksomhed), which the tagging convention already listed.
  • The NIS2 legal floor is now built in. NIS2 Art. 21 requires the same measures of essential and important entities, but the tier map sent important entities to Essential, which lacked supply-chain security, risk analysis, cryptography and exercises, and the criteria put management training at Level 4. Now every measure of Art. 20, 21 and 23 has its minimum form in the Essential tier and the Level 2 criteria, marked NIS2 in the checklist and the tool. Tiers are chosen on size, complexity and threat, no longer on NIS2 category, and the legal floor states that neither tier nor target relieves anyone of a legal requirement. The capability index gains a NIS2 column. Tier changes: GV-6, ID-5, ID-6, PR-3, PR-4, RS-4, RS-6 and RS-7 move to Essential; DE-5 hunting and PR-8 move to Standard.
  • New: NIS2 Article 21 crosswalk mapping Art. 20, 21(2)(a)–(j) and 23 to capabilities and to the Level 2 criteria that meet the minimum, and NIST CSF 2.0 crosswalk mapping the 22 CSF categories to OCDF capabilities.
  • One source for the maturity criteria. The function documents carried their own criteria tables, which had drifted from the checklist and the tool. They now link to the checklist, which is the single source; the tool carries the same text.
  • Consistency checked on every build. tools/check_consistency.py fails the site build if the criteria, the skill catalogue, the country data or the capability IDs differ between the files that carry them.
  • Team skill matrix fixed. The tool's skill catalogue had come back from a reverted restructure and no longer matched the self-assessment sheets: ratings for ten IDENTIFY and PROTECT skills were shown against the wrong skills, one skill was dropped and four were always empty. The catalogue, role targets and demo team now match the 47-skill sheets again. Ratings saved in the browser are keyed by skill ID and display correctly after the fix.
  • Country data from one file. Annex facts lived in three copies, the annexes, the annex index and the selector, and had drifted. docs/annexes/countries.json is now the only place they are edited; tools/build_countries.py writes the rest.
  • Country corrections. Netherlands: in force since 15 August 2026, was "expected ~1 July". Poland: in force since April 2026, was "pending". Austria: NISG 2026 in force 1 October 2026, with the new Bundesamt für Cybersicherheit and USP reporting. France, Ireland and Spain: the Commission's referral to the Court of Justice on 9 July 2026 noted. Denmark: the energy-sector act is Lov nr. 258/2025 with five preparedness levels, its incidents go to Energistyrelsen rather than virk.dk, and real-time monitoring applies at the higher preparedness levels, not as a blanket 24/7 duty; the selector, annex, maturity model and ABOUT are corrected.
  • Reporting duties completed. CER Art. 15, NIS2 Art. 23(1)–(2) to the recipients of your services, and the Art. 23(3) meaning of significant, with Implementing Regulation 2024/2690, are added to RESPOND, the IR plan template and the selector; the IR template gains the DORA deadlines.
  • Contradictions resolved. The greenfield build sequence no longer puts response and reporting after 9–22 months; every function starts in the first 90 days in minimum form. The operating-model document no longer presumes 24/7, no longer demands SOAR from day one, and distinguishes monitoring-only MSSP, MDR and co-managed SIEM, with the provider's containment mandate written into the containment catalogue. Crown jewels at Level 2 are agreed in writing, as the 90-day plan already required.
  • One path through the framework. The README's "How to use it" now follows the same seven steps as Start building on the website; the documentation index says the reading order is for reading, not for the order of work.
  • CIA mapping completed for all 43 capabilities, with enablers such as governance and exercises marked as such instead of left out.
  • Honest scope and claims. The scope line says cloud and SaaS depth is still to come. "Balanced beats spiky" is argued from the dependencies between functions, not from attackers "using the weakest function". The benchmark no longer calls contributions anonymous: they are not anonymous to the maintainer, only in what is published.
  • Smaller fixes. GV-5 covers the CDC team's own training and PR-1 the CDC's own platforms, closing the gaps the SOC-CMM mapping showed. RS-2 says which playbooks OCDF ships and which it does not yet. The worked example handles GDPR Art. 33 for its mailbox incidents and shows three functions below the legal floor at week 12. The roadmap separates what is planned from ideas. VERIS links point to verisframework.org, SIM3 references name v2 interim, the CRA reporting date is given as 11 September 2026, and the 20 numbered duplicates left in docs/ by the v1.1.0 rename are deleted; their URLs still redirect.
  • An old resume link can no longer wipe newer work. Opening a link used to replace the answers saved in the browser without asking, so a bookmark from the first day overwrote everything done since. When a link and the browser's copy differ, the tool now keeps the browser's copy on screen and asks which to continue with, showing how many criteria each has answered and when each was last changed. Links now carry that date.
  • "Start over" in the maturity tool clears the screen too. It reset the saved answers but left the criteria showing their old statuses and evidence until the page was reloaded.
  • Denmark's national CSIRT is named SAMSIK throughout, by its current name only, in the annex, the selector and the country data.

Scoring changes

Criteria set 2 replaces set 1: 71 criteria instead of 60. Saved assessments and resume links from earlier versions are migrated automatically in the tool; answers move with their criteria, and new criteria start as not considered. Expect many Level 2 scores to drop until the new floor criteria are answered.

  • Moved to Level 2: management body approval and training, now required within 12 months without the exercise, from GOVERN L4; the offline or immutable backup copy, from PROTECT L3; the reporting drill, from RESPOND L3.
  • New at Level 2: GOVERN security requirements with critical suppliers, and effectiveness assessed annually; IDENTIFY risk analysis within 12 months, and a short threat profile, which DETECT L2 already relied on; PROTECT cryptography policy, awareness training for all staff, and security requirements when buying or changing critical systems; RESPOND escalation into crisis management.
  • Changed: IDENTIFY L2 crown jewels are agreed in writing with the business instead of listed. RECOVER L2 now asks for a crown-jewel service restored end to end against its RTO, so it no longer duplicates PROTECT's restore test. GOVERN L3 supplier criterion is now annual supplier risk review. IDENTIFY L3 now asks that risk results drive budget and backlog.
  • New at Level 3 and 4: PROTECT L3 backup infrastructure separated from the production identity domain; RESPOND L3 exercises include management and communications; GOVERN L4 board-level crisis exercise.
  • Benchmark: contributions now carry criteria_set; only set 2 is aggregated.

Corrections from verification

The changes above were then verified from a fresh copy of the merged main: automated checks, a strict site build, the three tools, and the Danish energy rules read against the primary sources on retsinformation.dk.

  • Danish energy sector checked against BEK 260. Real-time monitoring and response apply at preparedness levels 4 and 5, not level 5 only, §§ 66–69; every entity segments its supply-critical systems, and levels 4 and 5 separate them physically, § 62; incidents that compromised network and information security also go to the CSIRT through its designated channel, and electricity, gas and hydrogen entities alert Energinet, §§ 77–79. Exercise and supervision frequencies are now cited to §§ 21 and 108. The earlier text relied on a secondary source.
  • Migration no longer overstates. Four criteria were tightened in set 2. An earlier met answer on one of them now arrives as partially in place, with a note in the evidence field saying what to re-check, instead of counting as met.
  • Tiers. "Pick your tier on regulatory category" is gone, in line with the legal floor. DE-2 has a basic form in Essential, so an Essential organisation can reach DETECT Level 2 as its target says. The legal floor no longer claims to cover everything: human-resources security and vulnerability disclosure are named as thin.
  • Crosswalk. The signed charter is no longer listed as a legal minimum for Art. 20; RS-1 is marked for Art. 21(2)(j), out-of-band communications. One more numbered cross-reference, "Doc 13", is replaced by a link.

v1.1.0 — 2026-09-23

A usability and scoring release, built from three practitioner reviews of v1.0.0, plus a new community benchmark. It changes two DETECT maturity criteria; see Scoring changes below before comparing an assessment with one made under v1.0.0.

  • Community benchmark, open for contributions. The maturity self-assessment gains a Compare with others panel: tell it your size band, NIS2 category, region, sector and operating model, and once enough organisations have contributed it shows the median level per function for similar organisations, and for each criterion the share that have it in place. Figures are published only for groups of ten or more, one attribute at a time. Users can contribute their own result anonymously: the tool shows exactly what is included (the five answers, the month, the framework version and the 60 statuses; no names, evidence, owners, dates or targets) and the user sends it by email. Raw contributions are never published; benchmark/aggregate.py produces the public tools/benchmark.json and scores exactly as the tool does. A new page explains the benchmark and summarises what SOC-CMM and ENISA have published in the meantime.
  • "Start over" button on the maturity tool. A clearly marked button in the header clears every saved answer, evidence note and assessor detail in this browser and begins a fresh assessment; a confirmation dialog spells out what is about to be lost so it can't be triggered by a stray click. The existing "Clear all answers" option (which keeps the assessor details and targets) stays available in the assessment-details panel.
  • Numbers dropped from document URLs and filenames. The 20 numbered framework documents (docs/01-govern.md and so on) are renamed without their leading number (docs/govern.md); the "Document N" kicker this used to produce on the website is gone along with it, since the number no longer exists to lift out of the heading. mkdocs-redirects maps every old numbered URL to its new one, so existing bookmarks and external links into opencdc.org keep working. The 26 in-prose cross-references that cited other documents by number ("see doc 14") now link to them by name instead, and the reading-order index and national-annex table no longer show raw filenames as link text.
  • Landing page and navigation decluttered. The sidebar no longer forces every section (27 annexes, 9 templates, 7 playbooks) permanently open — navigation.sections is off, so it now behaves as a collapsed accordion. The "framework in one picture" diagram's two extra boxes are folded into one caption line, the "Start building" steps read as a lightweight list instead of bordered boxes, and two admonitions on the landing page are merged into one muted footnote. The footer's lone "next" link (with no "previous" to pair against on the landing page) now sits on the right, where a forward link belongs, instead of the left.

Corrections from a final self-review before release:

  • Version and roadmap. The site said v1.0.0 while its criteria had changed; this release is v1.1.0, and the release checklist in PUBLISHING.md now lists all six places the version appears. The roadmap groups planned work as Next, After that and Later instead of future version numbers, so plans can move without renumbering.
  • Source labels on every framework document, not only the six functions and Start here, and the trust page now describes exactly what was checked: identical criteria in the checklist and the tool, and every capability ID in the index.
  • NIS2 clock described precisely. The 24 hours run from becoming aware of a significant incident. The executive guide, the worked example and the coverage-hours table argued as if the clock started at the attack.
  • DORA timing completed: four hours from classification as major, and no later than 24 hours from awareness.
  • Overclaim removed. The executive guide said nothing but detection shortens attacker dwell time.
  • Business-hours staffing explained. The 3–4 people for business hours with on-call now has its arithmetic, next to the 24/7 calculation, including why the on-call rota usually sets the minimum.
  • Clearer labels: the annex index separates legal status from confidence; the one-page overview mentions evidence-based scoring; skill IDs such as GV-01 are explained as separate from capability IDs such as GV-1.
  • Navigation. The Start menu drops from nine entries to seven; the introduction and the reading-order index move to Framework. The analyst entry on the landing page leads to Running the CDC, and the landing page no longer claims templates "work offline".

Changes from a third review, by a senior SOC/CDC manager, whose verdict was "an excellent framework, not yet an equally excellent product": the content was stronger than the experience of finding your way into it.

  • New landing page. Entry points by role (executive, SOC manager, analyst or engineer, compliance), the whole framework in one picture, and a seven-step "start building" path that links each step to the page or tool that does it. The old six feature cards are folded into these.
  • OCDF on one page. Every term the framework uses, such as functions, capabilities, tiers, levels, criterion status, operating models and dependency markers, explained in one table with how the pieces fit.
  • Executive guide. The 30-minute version for a CISO, board member or sponsor: what a CDC is, the risk it reduces, what NIS2 asks of management, what good looks like, staffing and cost drivers, what can and cannot be outsourced, a 12/24/36-month roadmap, board metrics and ten questions to ask the SOC.
  • Worked example. A fictional 2,500-person Danish parcel company taken through the framework: tier, operating-model decision, team, targets, signed charter excerpt, first 90 days with owners, a ten-detection portfolio, the maturity baseline turned into an action plan, and the first board report.
  • Source labels. Sections that make claims are labelled Law, Standard, Guidance, OCDF or Practitioner, across the six function documents and Start here. A new page, Why trust this framework, explains the labels, what has been checked and what has not.
  • Annex confidence levels. Each national annex now states one of four levels, from verified against primary source to pending legislative change, in its status block and in the index. None is yet at the top level; that is stated openly.
  • Operating-model decision path. The "score each criterion 1–5" table is replaced by five questions taken in order, each of which can decide the model. The design navigator's question G6 follows.
  • Maturity tool: owner and due date per criterion, and an action-plan export. The open-actions list shows who owns each gap and by when, counts how many are still unowned, and exports as a spreadsheet file that opens directly in Excel, including Danish Excel. Owners and dates travel in the resume link and the snapshot file; older links still open.
  • Capability index filters by function, by the tier you are at, and by free text.
  • Unsourced claim reworded. "Evidence-free self-assessment inflates scores by roughly one level" was stated as fact in four places; it is now presented as the author's observation.
  • Roadmap. The cloud CDC profile moves up from Later with the scope the review proposed; the next group of work gains filled-in template examples, worked examples at other sizes and a machine-readable framework; a CDC builder is added under Later.

Not taken up from the review

  • A reference "25-person SOC": the review's own example described six people plus a managed service. The worked example uses that team, inside a 2,500-person company.
  • Reference architectures for 50, 500, 5,000 and 50,000 employees: one worked example first, done properly; the other sizes are on the roadmap.
  • The CDC builder: the review's strongest idea, and a real project. It needs the machine-readable framework first, so it is on the roadmap rather than rushed.

Changes from a second, deliberately critical review by a senior SOC manager:

  • Staffing and cost, with the arithmetic. Operating models gains "Staffing and cost: the arithmetic": how many people one seat takes around the clock, worked through step by step with inputs to replace; how the 8–12 FTE figure for a 24/7 line is built; how to make the lone night analyst safe; the cost lines to estimate, and what to watch for in each; and a three-year comparison table across the operating models. The staffing notes in DETECT and Model B now link to it.
  • ATT&CK coverage metric tightened. The metrics template now counts only techniques in your threat profile at level 3 on the honesty scale from the detection-as-code deep dive, drops the fixed 70% target in favour of a trend with the uncovered techniques named, and adds whole-matrix coverage and rule counts to the anti-patterns.
  • Roadmap regrouped. The planned work after v1.0.0 was labelled v0.2 and v0.3, lower than the release already out. It is now grouped as Next, After that and Later, so plans can move without renumbering, and the roadmap explains how releases are numbered. References in ABOUT, README, the landing page, the tools README and the IR plan template follow.

Scoring changes

Two DETECT criteria changed. Assessments made under v1.0.0 can move, so compare with care:

  • Level 3: "24/7 monitoring, in-house or hybrid" becomes "Coverage hours meet the risk-based target set in GOVERN; out-of-hours escalation tested twice a year". Maturity measures how well detection works; how many hours a day someone watches is a risk decision. Under the old wording a well-run business-hours team, the capability-based Model C the framework itself describes, could never pass Level 2 in DETECT. The maturity model gains "Coverage hours are a target, not a level", with typical targets per organisation type. A DETECT score can rise under the new wording; it cannot fall.
  • Level 2: "≥ 20 documented use cases mapped to ATT&CK" becomes "Use cases documented for the top techniques in the threat profile, each with owner, ATT&CK mapping and runbook". A rule count is the vanity metric the framework warns against elsewhere. A team with twenty unfocused rules may now fail this criterion; one with fewer rules aimed at its real threats may now pass.

The interactive self-assessment keeps the same number and order of criteria, so existing resume links and snapshots still open; a criterion marked implemented under the old wording keeps that status and should be re-checked against the new one.

  • Maturity self-assessment redesigned as a workspace, inspired by the SIM3 self-assessment tool. Criteria sit on the left with one tab per function, each tab showing the function's level and how many criteria are met. A results panel on the right stays in view and updates on every click: target profiles as buttons, summary tiles, and three views: the score chart, the Result table, and a new Open actions list of the criteria still missing to reach your targets, each of which jumps to the criterion. Status is set with one click on a five-button row instead of a dropdown. On phones the results move below the criteria, with a summary bar pinned to the bottom of the screen. Scoring, resume links and snapshot files are unchanged, so existing links and exports keep working.

Changes from a practitioner review of the site: a CDC manager from critical infrastructure read it cold and listed what would stop them relying on it.

  • Critical infrastructure and OT. ABOUT gains "If you run critical infrastructure": what applies as written, what the CDC should own at the IT/OT boundary even without an OT profile, and what does not transfer. The OT/ICS profile moves up from "Later" on the roadmap. The landing page and README link to the new section.
  • Annex currency. All 27 national annexes open with a status block: last verified, verified by, second reviewer and next review due. The annex index shows the same columns under a "one reviewer so far" warning and commits to re-verification at least every six months.
  • Reusing past assessments. The maturity model gains a SOC-CMM → OCDF mapping by aspect, a rough and explicitly uncalibrated score translation, and pointers to the existing SIM3 and CIS Controls crosswalks.
  • Attack-based playbooks, published as drafts for field review: PB-IDC identity compromise, PB-BEC business email compromise and PB-RAN ransomware. They sit above the platform playbooks and hand off to them. PB-IDC fixes the containment order explicitly: block sign-in first, then revoke sessions immediately, because revoking while the account is enabled lets a password holder sign straight back in.
  • Trust signals. The landing page shows the version and a "How current is this?" box. ABOUT gains "Maintainers and adoption", which states that there is one maintainer, that p0jst is the author, and invites teams to ask to be listed as users.
  • Author bio updated to "formerly Senior Manager at the Norlys Cyber Defence Center" on the About page, README and landing page.

v1.0.0 — 2026-09-02

First stable release. The framework is content-complete across all six functions, the regulatory layer and the practical assets; see the release notes for status and limitations, in particular that the reporting-deadline tables have not had independent legal review and nine national annexes still carry verification flags.

Since the v0.1-rc1 freeze candidate:

  • Persistent previous/next bar. A slim bar slides in once you are past the first screenful of a page and hides again when the footer cards come into view, so the two never compete; it also steps aside for the mobile drawer and the search overlay. Built from MkDocs' own page order in overrides/main.html rather than scraped from the DOM.

  • More filename links rewritten as prose. The earlier sweep only matched paths beginning ../, so same-directory references such as [tiers.md](tiers.md) survived in body text. Twenty-one more rewritten, including the shared "Credits" footer across the ten numbered documents. Filenames are kept where the filename is the point: the README's document tables and the annex index's file column.

  • "Edit this page" action removed via content.action.edit: the pencil beside each page heading read as interface clutter. site/hooks.py, which existed only to repoint that action for the two website-only pages, goes with it; edit_uri stays in mkdocs.yml with a note, so re-enabling is a one-line change.

  • Continue-reading navigation made visible. The documents are numbered and meant to be read in order, so the previous/next links are a primary control, but Material renders them small and low-contrast inside the dark footer, where they are easy to miss entirely. They now sit on the page ground as cards matching the rest of the site, with the direction label in the accent red and a hover lift. On narrow screens the two cards stack and both stay labelled. Material hides the previous title by default, which with card styling left an empty box holding one arrow.

  • Link previews: assets/social-preview.png, a 2560x1280 card in the site's own palette, typography and blueprint texture, plus Open Graph and Twitter card tags via a small theme override in overrides/main.html, so a link to opencdc.org shared into Slack, LinkedIn or a chat renders as a card rather than a bare URL. The same file is what should be uploaded as the repository's GitHub social preview.

  • Heading permalinks turned off via toc.permalink: false: the paragraph-mark anchor that appeared beside every heading on hover read as a stray glyph rather than an affordance. Heading ids are still generated, so every section stays linkable. The table of contents links to each one and puts the anchor in the address bar.

  • RESPOND gains "the first hour of a major incident" — the estate-wide moves that sit above any single playbook and are most often skipped under pressure: do not power systems off; cut external connectivity with a perimeter deny-all including VPN, site-to-site, RDP/VDI gateways and vendor/out-of-band paths; verify and then isolate backups; extend snapshot retention before defaults roll it off; and stand up emergency log collection where there is no aggregator. Plus a counsel and insurance subsection: cyber policies commonly mandate notification windows and pre-approved responder panels, and using your own first can reduce cover. Legal privilege over investigation reports is not uniform across member states either. Settle both before an incident, not during one.

  • RECOVER notes that the recovery path is decided during response: pre-intrusion snapshots are often the cleanest restore point and expire on schedule regardless of the open incident.
  • Containment action catalogue gains five estate-level rows, CON-11 to CON-15: perimeter deny-all, remote-access disable, backup isolation, snapshot-retention extension and emergency log collection. These are the actions whose authority most needs pre-agreeing.

  • IR plan template: external counsel and cyber insurance contacts added to the roles table, and the containment step points at the first-hour actions.

  • New platform playbook: playbooks/PB-WSV-windows-server.md — Windows Server, including domain controllers. Same structure as the existing three: prerequisites, triage, containment, RFC 3227 acquisition table, artefacts, analysis, eradication and reporting hooks. The server-specific weight sits where it belongs: Tier 0 blast radius, the identity-fabric consequences of a DC compromise, AD-specific evidence such as ntds.dit, SYSVOL, replication metadata and DCSync-shaped access, ADCS as a persistence path, and a recovery section that covers the double krbtgt reset and when to stop cleaning and execute the forest-recovery plan. Wired into the playbook index, the site nav, the landing page, the root README and the IR plan template.

  • Roadmap: added "more platform playbooks" to v0.2 with candidate targets.

  • Fixed lists that never rendered as lists. Twenty-four blocks across nine documents had no blank line between the lead-in sentence and the first bullet, which GitHub's renderer tolerates but Python-Markdown does not, so on the website they collapsed into run-on paragraphs. Worst affected were the whole maturity self-assessment checklist, with all 60 criteria run together as prose, the three platform playbooks' artefact lists, and the charter's containment-authority lists. All 75 built pages now verify clean.

  • Checkboxes render as checkboxes via pymdownx.tasklist: the reference checklists showed a literal [ ] before every line. They are still not tickable in the browser, which is what the interactive tool is for, but they read as a checklist now.

  • The three playbooks' artefact lists lead with a bold category such as Event logs or Persistence, so they can be scanned, and inline code sits tighter in the surrounding text.

  • Document numbers moved out of the page titles: the numbered framework documents are staged for the website with their leading number lifted into a small kicker above the heading, reading "Document 11" and linked to the reading guide, so the title reads as a title. The number stays visible and searchable, since 56 in-prose cross-references cite documents by number, but it no longer arrives as the first word a reader sees when they land from the navigation. The repository markdown keeps its numbered headings, where the number carries the file's reading order.

  • Typography and link legibility: the site and the three tools now use IBM Plex Sans / IBM Plex Mono, self-hosted from assets/fonts/ under OFL-1.1. No request reaches a third-party font CDN, which keeps the site's own privacy posture intact. Latin, Latin-extended, Greek and Cyrillic subsets are included so the native-language law names in the national annexes render in the same face; anything outside them falls back to the system stack. Links now carry a persistent underline: the navy reads at 10.9:1 against the paper but only 1.85:1 against body text, so colour alone was not a reliable signal that something was a link, where WCAG 1.4.1 asks for 3:1. Navigation, buttons and heading anchors stay undecorated. The permalink anchor is hidden in the landing-page hero, where the page has no table of contents to link into.

  • Site-wide review fixes: bare URLs throughout the references and the 27 national annexes now render as real links via pymdownx.magiclink, covering 218 external links across 53 hosts that were previously plain text; the interactive-tools page is reachable from the sidebar again, since Material was hoisting it into the section title, and now links to each of the three tools; the "edit this page" action on the two website-only pages points at their real sources in site/ through site/hooks.py; README points at opencdc.org rather than the github.io address; reassessment cadence is stated the same way in the README, the design navigator and the maturity model, as annually with quarterly action reviews; tools/README.md is ordered Tool 01 → 02 → 03; and the maturity tool's print stylesheet matches the other two.

  • Five-point status scale in the maturity self-assessment, replacing the yes/no checkbox: not considered · planned · partially in place · implemented · implemented & evidenced. Only the top two count towards a level, so staged scoring is unchanged; the lower states drive a new progress view: a hatched segment on the score chart showing how far into the next level each function has come, a "planned or partly in place" tile, and a per-function breakdown in the Result table. An evidence-based scoring toggle counts only "implemented & evidenced", the reading to use when the assessment leaves the room. Documented as part of the scoring method in docs/maturity-model.md, mirrored as a status slot per criterion in assessments/maturity-self-assessment.md. Existing snapshots, browser copies and resume links keep working, and a ticked box reads as "implemented".

  • Navigation in the interactive tools: all three tools now carry a breadcrumb bar back to the framework. They are standalone pages outside the MkDocs theme, so they had no header, logo or way home.

  • Resume links in the maturity self-assessment: the tool now encodes the whole assessment, meaning answers, evidence notes, targets and header fields, into the page's URL fragment, so you get a unique link that restores exactly where you left off. Copy it, mail it to yourself, share it with a colleague; works on any device or browser without an account, a cookie or a server, and the fragment is never sent in an HTTP request. Highlighted as a "Save & resume" panel at the top of the tool, with a warning when evidence notes push the link past ~2 000 characters.

  • Website look & feel: refreshed theme in site/extra.css and a refreshed landing page: full-width hero with an at-a-glance stat strip, feature cards with icon chips and hover lift, a "Where to begin" three-step section, and tightened typography, tables and admonitions. Same minimal, document-like identity; no new dependencies or webfonts.

  • Interactive maturity self-assessment, Tool 03: tools/maturity-assessment.html, the maturity checklist filled out in the browser instead of as inert markdown checkboxes. Real checkboxes with evidence fields for all 60 criteria, staged auto-scoring per the maturity model's rules, target-profile presets from docs/maturity-model.md, a score-vs-target chart, a Result table naming exactly which criteria block the next level, and JSON snapshot export/import for tracking the trend. assessments/maturity-self-assessment.md now links to it at the top; landing page's "Assess your maturity" button points to it directly.

  • Website: the framework now publishes as an MkDocs Material documentation site via GitHub Actions, with a landing page, full-text search and theming to match the tools; site/ holds the landing page, theme CSS and staging script, mkdocs.yml the nav, .github/workflows/publish-site.yml the deployment. Repo layout and all links unchanged.

  • Team skill mapping added to the Roles & Competences layer:

    • templates/skill-self-assessment.xlsx, with a CSV version alongside it. A 47-skill self-assessment sheet across 8 domains: the six CSF functions plus Platform & Automation and Professional Skills, rated 0–3 on the framework scale with a per-skill "want to grow?" flag
    • tools/skill-matrix.html, Tool 02. A single-file, dependency-free team skill matrix: upload returned sheets cumulatively, overwriting per person; team heatmap with coverage/bus-factor flags, gap analysis against editable per-role targets, train/mentor/hire action view, JSON snapshot export/import
    • New "Team skill mapping" section in docs/roles-and-competences.md, covering process, cadence, GDPR ground rules and hiring hook

v0.1-rc1 — freeze candidate, 2026-07-15

Project name approved: Open CDC Framework (OCDF). First feature-complete release candidate. Contents:

  • Six NIST CSF 2.0 function documents with CIA mapping, four-level maturity criteria, EU regulatory hooks, and external-dependency tables using the [GATE], [HARD] and [SOFT] convention
  • Design layer: CIS-ordered Start Here prioritisation, E/S/A implementation tiers, operating models covering MSSP, tiered, capability-based and shared CDC, ECSF-based roles and competences
  • Operations layer: tuning loop, detection-as-code plus an engineering deep dive with Sigma/YAML, CI/CD and honest ATT&CK coverage scoring, a CTI deep dive across the strategic, operational and tactical levels, automation & AI-triage guardrails, tool portfolio discipline, SIEM ownership incl. cloud data considerations
  • Community layer: RFC 2350, TF-CSIRT/FIRST, SIM3 crosswalk, living-documentation controls, annual calendar
  • Regulatory layer: EU landscape across NIS2, GDPR, DORA, CRA and CER; 27 national annexes with status verified July 2026; interactive law selector, CIS Controls v8 crosswalk with concrete actions
  • Practical assets: 9 templates, 3 platform IR/forensics playbooks for Win11, macOS and RHEL; design navigator, maturity self-assessment

Known pre-v1.0 work: fill ABOUT placeholders; legal review of reporting-deadline tables and national law references; re-verify the "pending" annexes for FR, IE, LU, ES, PL and NL; set final repository URL in docs/references.md citation line.