In SIM3 we define “Baselines” as a well-defined set of minimum values for all or a subset of SIM3 Parameters, in a specific context. A Baseline can also have additional demands or instructions, independent from SIM3.
The oldest Baseline is the TF-CSIRT Certification Baseline which dates from 2010. This is used for the purpose of TF-CSIRT Certifications and re-Certifications (every 3 years). Accredited TF-CSIRT members can choose to apply for Certification – this is not mandatory. The Baseline is represented in the SIM3 Online Tool.
Next came the ENISA Baselines Basic, Intermediate and Advanced originally developed by ENISA with support of OCF for national and sectorial teams in the EU. These were and are used by the EU’s CSIRTs Network. However many more national and sectorial teams outside the EU – and even commercial teams have embraced these 3 Baselines. The GFCE has also adopted them in the Global Cybersecurity Maturity Framework (GCMF). These Baselines are represented in the SIM3 Online Tool.
Note: ENISA has in 2024 devised a Baseline called Expert that is beyond Advanced maturity wise, as a result of the EU NIS2 Directive. OCF will publish this in the first half of 2025.
FIRST and OCF together developed a limited Baseline that is used as part of the FIRST Membership process. The minimum demands here are limited to 11 out of the 45 Parameters. This Baseline too is represented in the SIM3 Online Tool.
In 2024 the Organization of American States (OAS) with support of OCF developed the CSIRTAmericas Baseline. This Baseline has minimum demands for all 45 Parameters and is used for national and sectorial teams who have requested to join the OAS CSIRTamericas cooepration. The OAS has published this Baseline in English and in Spanish.
As OCF we aim to keep the number of Baselines relatively low, as a too high number would only lead to confusion. Especially the three ENISA/GFCE Baselines Basic, Intermediate and Advanced are very suited for general use, wherever you are on the planet. If you think that in your organisation or collaboration you really have need of a separate SIM3 Baseline which is not covered by any existing one, please get in touch with us at OCF to discuss this. Thank you!