CDC Controls Register — Template¶
Keeps the documentation alive: every key artefact gets an owner, a frequency, and an approver from OUTSIDE the CDC's reporting line. Evidence of each executed review is stored with the control. See docs/16-csirt-community.md §4.
| Control ID | What is verified | Framework ref | SIM3 ref (optional) | Frequency | Owner (CDC) | Independent approver | Last done | Evidence |
|---|---|---|---|---|---|---|---|---|
| C-01 | Charter: mandate, scope, authority current and signed | GV-1 | O-1/O-3 | Semi-annual | ||||
| C-02 | Containment action catalogue accurate & tested | RS-4, catalogue template | O-3 | Semi-annual | ||||
| C-03 | Severity & closure classification applied consistently (sample) | IR plan §1 | O-8 | Quarterly | ||||
| C-04 | Statutory reporting contacts & templates current; drill held | RS-5 | P-14 | Semi-annual | ||||
| C-05 | Standard mailboxes & RFC 2350 reviewed | 16-csirt-community §1 | P-10 | Yearly | ||||
| C-06 | Service & SLA description matches reality | Charter §3 | O-5/O-7 | Semi-annual | ||||
| C-07 | Community memberships recorded; regulator notified of changes where required | 16 §2 | O-9 | Yearly | ||||
| C-08 | Maturity self-assessment executed; gaps in roadmap | assessments/ | P-8 | Yearly | ||||
| C-09 | Skills matrix reviews held for all staff | docs/11 | H-3/H-4 | Semi-annual | ||||
| C-10 | Detection validation coverage (% rules fired in test) | DE-6 | — | Quarterly |
Template from the Open CDC Framework (CC BY 4.0). SIM3 © Open CSIRT Foundation — parameter references for cross-audit convenience.