Documentation index
New here? Start with OCDF on one page for the terms, the executive guide if you are sponsoring or funding a CDC, or the worked example to see the framework applied to one organisation. Why trust this framework explains what is law, what is standard and what is the author's judgement.
To build a CDC, follow the seven steps under Start building on the home page; they are the one path through the framework, and each step links to the page it needs. The reading order below is for reading the framework through, not for the order of work.
Reading order: start with the introduction, then start here to prioritise and implementation tiers to pick a tier, then the six functions below with CIA as design lens and the maturity model alongside them, then operating models through running the CDC for organisation and operations, then the advanced and community layers, then the regulatory and CIS crosswalks. References holds all credits. Dependency markers [GATE]/[HARD]/[SOFT] are defined in the introduction.
| Document | What's in it |
|---|---|
| Introduction | Purpose, principles, scope boundary, dependency markers |
| The six NIST CSF 2.0 functions | GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER |
| CIA as design lens | How confidentiality, integrity and availability shape the controls |
| Maturity model | Maturity levels & scoring |
| Start here | Prioritisation: 90 days / year 1 |
| Implementation tiers | Essential / Standard / Advanced overlay |
| Operating models | MSSP / tiered / capability-based / shared |
| Roles & competences | ECSF-based roles & skills |
| Running the CDC | Tuning, detection-as-code, team, automation, tools |
| Designing alert triage | Decision rights, the minimum triage record, one set of outcomes, automation split, quality checks |
| AI in the CDC | AI uses by team size, AI in the adversary's hands, AI systems as assets, the AI Act |
| The IT/OT interface | What the CDC owns at the OT boundary, handover to OT operations, Danish energy coverage |
| Detection-as-code deep dive | Advanced: engineering manual |
| CTI deep dive | Advanced: CTI programme |
| CSIRT community layer | Community, certification, living docs |
| EU regulatory landscape | EU law layer, plus annexes |
| NIS2 Article 21 crosswalk | NIS2 obligations → capabilities and the Level 2 floor |
| NIST CSF 2.0 crosswalk | CSF 2.0 categories → capabilities |
| CIS Controls crosswalk | CIS Controls with concrete actions |
| References | Sources & credits |
Every capability ID used across these documents, such as GV-1 or DE-4, is listed with its document and tier in the capability index.