CDC Controls Register — Template
Keeps the documentation alive: every key artefact gets an owner, a frequency, and an approver from OUTSIDE the CDC's reporting line. Evidence of each executed review is stored with the control. See CSIRT community layer §4.
| Control ID | What is verified | Framework ref | SIM3 ref, optional | Frequency | CDC owner | Independent approver | Last done | Evidence |
|---|---|---|---|---|---|---|---|---|
| C-01 | Charter: mandate, scope, authority current and signed | GV-1 | O-1/O-3 | Semi-annual | ||||
| C-02 | Containment action catalogue accurate & tested | RS-4, catalogue template | O-3 | Semi-annual | ||||
| C-03 | Severity & closure classification applied consistently, on a sample | IR plan §1 | O-8 | Quarterly | ||||
| C-04 | Statutory reporting contacts & templates current; drill held | RS-5 | P-14 | Semi-annual | ||||
| C-05 | Standard mailboxes & RFC 2350 reviewed | CSIRT community layer §1 | P-10 | Yearly | ||||
| C-06 | Service & SLA description matches reality | Charter §3 | O-5/O-7 | Semi-annual | ||||
| C-07 | Community memberships recorded; regulator notified of changes where required | CSIRT community layer §2 | O-9 | Yearly | ||||
| C-08 | Maturity self-assessment executed; gaps in the improvement backlog | Maturity self-assessment | P-8 | Yearly | ||||
| C-09 | Skills matrix reviews held for all staff | Roles & competences | H-3/H-4 | Semi-annual | ||||
| C-10 | Detection validation coverage, % rules fired in test | DE-6 | — | Quarterly |
Template from the Open CDC Framework, licensed CC BY 4.0. SIM3 © Open CSIRT Foundation; parameter references are for cross-audit convenience.