Contributing to the Open CDC Framework

Thank you for helping European teams defend better. Contributions of all sizes are welcome.

What we're especially looking for

National annexes — NIS2 transposition specifics, national CSIRT contacts and reporting portals, per member state. Status, law, authority, CSIRT and review dates are edited in docs/annexes/countries.json and written out by python tools/build_countries.py; country notes and anything longer go in docs/annexes/annex-<ISO country code>.md, outside the generated block.
Translations — the framework aims to be available in EU languages, under i18n/<lang>/.
Templates — improvements to the playbook templates, report templates for statutory notifications. OCDF does not ship ready-made playbooks.
Corrections — factual, regulatory, or attribution fixes; high priority, so open an issue immediately.
Field feedback — did the maturity criteria match reality in your assessment? Open a discussion.

Vendor neutrality: no product names in normative documents. Tooling examples belong in clearly marked non-normative appendices and must include open source options where they exist.
Credit everything: any content derived from another work must be attributed in the document's Sources section and in docs/references.md. Respect the source's license.
No confidential material: never contribute internal documents, real incident data, or client information.
Regulatory content: cite the EUR-Lex ELI link for any legal claim, and mark interpretation clearly as interpretation.
Language: contributions in English for core docs; translations maintained separately.

Open an issue describing the change, using the templates.
For text changes: fork → branch, named docs/<topic> or fix/<topic> → pull request referencing the issue.
One logical change per PR; keep the document structure intact for function docs: Objective, Capabilities, CIA mapping, Roles & staffing, Maturity, EU hooks, External dependencies, Sources.
Maturity criteria are edited only in assessments/maturity-self-assessment.md, then mirrored in the tool's CATALOG. Any change to a criterion is a scoring change: note it in the changelog, and if it moves or adds criteria, raise CRITERIA_SET and extend the migration map in the tool.
Run python tools/check_consistency.py before opening the pull request; the site build runs it too and fails on drift.
Diagrams are generated, not drawn: edit tools/build_diagrams.py and run python tools/build_diagrams.py, which writes a light and a dark SVG per diagram to assets/diagrams/. Do not edit the SVG files by hand.
A maintainer will review for accuracy, neutrality, and attribution before merging.

By contributing, you agree that your contribution is licensed under CC BY 4.0, and you confirm you have the right to submit it.

Be professional and constructive. Disagreement about content is welcome; disrespect toward people is not. Report issues to the maintainers.