References & Credits

This framework synthesises and builds upon the following publicly available works. OCDF is an independent community project and is not endorsed by, affiliated with, or approved by any of the organisations below.

Primary framework backbone

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024. https://doi.org/10.6028/NIST.CSWP.29. NIST publications are U.S. Government works, not subject to copyright in the United States.

NIST Special Publications & standards

• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, 2025. https://doi.org/10.6028/NIST.SP.800-61r3
• NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. https://doi.org/10.6028/NIST.SP.800-53r5
• NIST SP 800-92, Guide to Computer Security Log Management.
• NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.
• NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems. https://doi.org/10.6028/NIST.FIPS.199

MITRE

• MITRE ATT&CK®. https://attack.mitre.org. © The MITRE Corporation. ATT&CK is used under MITRE's Terms of Use permitting use with attribution. ATT&CK® is a registered trademark of The MITRE Corporation.
• K. Knerler, I. Parker, C. Zimmerman, 11 Strategies of a World-Class Cybersecurity Operations Center, 2nd edition, MITRE. https://www.mitre.org/news-insights/publication/11-strategies-world-class-cybersecurity-operations-center

EU legislation from EUR-Lex

© European Union. Reuse permitted under Commission Decision 2011/833/EU.

• NIS2: Directive (EU) 2022/2555. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
• GDPR: Regulation (EU) 2016/679. https://eur-lex.europa.eu/eli/reg/2016/679/oj
• DORA: Regulation (EU) 2022/2554. https://eur-lex.europa.eu/eli/reg/2022/2554/oj
• Cyber Resilience Act: Regulation (EU) 2024/2847. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
• CER: Directive (EU) 2022/2557. https://eur-lex.europa.eu/eli/dir/2022/2557/oj
• Cybersecurity Act: Regulation (EU) 2019/881. https://eur-lex.europa.eu/eli/reg/2019/881/oj
• Commission Implementing Regulation (EU) 2024/2690, on NIS2 technical requirements for certain digital entities.

ENISA

• ENISA, European Cybersecurity Skills Framework (ECSF): Role Profiles and User Manual, September 2022, with a revision in progress. https://www.enisa.europa.eu/topics/skills-and-competences/skills-development/european-cybersecurity-skills-framework-ecsf

• ENISA, ENISA Threat Landscape, an annual report series. https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape

• ENISA, CSIRT Maturity Framework and CSIRT capability materials. https://www.enisa.europa.eu

Maturity models & incident response communities

• Rob van Os, SOC-CMM, the Capability Maturity Model for Security Operations Centers. https://www.soc-cmm.com. Free to use, and referenced here as a complementary deep-dive model.
• Open CSIRT Foundation, SIM3, the Security Incident Management Maturity Model. https://opencsirt.org
• FIRST, CSIRT Services Framework v2.1. https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1
• FIRST, Traffic Light Protocol (TLP) 2.0. https://www.first.org/tlp/
• TF-CSIRT / Trusted Introducer, for European CSIRT listing, accreditation and certification. https://www.trusted-introducer.org
• IETF RFC 2350, Expectations for Computer Security Incident Response; RFC 2142, Mailbox Names for Common Services, Roles and Functions.
• VERIS — Vocabulary for Event Recording and Incident Sharing. http://veriscommunity.net
• CMMI Institute, Capability Maturity Model Integration, the conceptual basis for staged maturity levels.

Incident response playbook baselines

• Microsoft, Incident response playbooks on learn.microsoft.com, with scenario runbooks to be adapted per environment. https://learn.microsoft.com/security/operations/incident-response-playbooks
• CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, 2021. https://www.cisa.gov

Digital forensics

• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. https://doi.org/10.6028/NIST.SP.800-86
• IETF RFC 3227, Guidelines for Evidence Collection and Archiving. https://www.rfc-editor.org/rfc/rfc3227
• Apple, Apple Platform Security Guide. https://support.apple.com/guide/security/
• Microsoft public documentation on BitLocker and Windows artefact behaviour. https://learn.microsoft.com
• Red Hat public documentation on auditd, LVM and systemd. https://docs.redhat.com

Danish legislation & authorities — retsinformation.dk and samsik.dk

• Lov nr. 434 af 6. maj 2025, Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau, the NIS 2-loven. https://www.retsinformation.dk/eli/lta/2025/434
• Lov om styrket beredskab i energisektoren, 2025, the energy-sector NIS2 and CER regime.
• Lov om sikkerhed og beredskab i telesektoren, 2025, the telecom NIS2 implementation.
• CER-loven, on kritiske enheders modstandsdygtighed, 2025.
• Styrelsen for Samfundssikkerhed (SAMSIK), NIS2 guidance. https://samsik.dk/nis2

Other

• CIS, CIS Critical Security Controls and CIS Benchmarks. The Implementation Groups pattern inspired OCDF's tier overlay. https://www.cisecurity.org
• Sigma, a generic signature format for SIEM detections; pySigma converters. https://github.com/SigmaHQ/sigma
• MITRE ATT&CK Navigator, for coverage layers. https://mitre-attack.github.io/attack-navigator/
• Red Canary, Atomic Red Team, an attack emulation library. https://github.com/redcanaryco/atomic-red-team
• CISA, Known Exploited Vulnerabilities catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MISP Project. https://www.misp-project.org
• ISO/IEC 27000-series, Information security management systems, covering vocabulary, ISMS requirements and controls. https://www.iso.org. ISO standards are paywalled; this framework references concepts only.
• IBM Plex Sans / IBM Plex Mono — the typefaces used by this website and its interactive tools. © 2019 IBM Corp., licensed under the SIL Open Font License 1.1. Self-hosted from assets/fonts/ so that no visitor request reaches a third-party font CDN; licence text in assets/fonts/LICENSE-IBM-Plex.txt. https://github.com/IBM/plex
• Donn B. Parker, Fighting Computer Crime: A New Framework for Protecting Information, Wiley, 1998, source of the Parkerian Hexad.

How to cite this framework

Open CDC Framework (OCDF), version 1.1.0, 2026. Licensed CC BY 4.0. Available at: https://github.com/p0jst/OpenCDC.

Corrections

Found a missing or incorrect attribution? Please open an issue; proper credit is a core value of this project.