The Certified SIM3 Auditors represent not only themselves and the organisation they work for – but when doing a SIM3 Audit or Assessment, also the Open CSIRT Foundation, as long as they are in good standing as Certified Auditors. All Certified SIM3 Auditors listed by OCF on this website are in good standing*.
All Certified SIM3 Auditors are expected to act, in spirit as well as factually, according to the Code of Ethics as presented on this page. This Code was prepared in a meeting of Auditors in Montréal (Canada, 7 June 2023) and finalised in a similar meeting on Tenerife (Spain, 28 February 2024).
GENERAL PRINCIPLES
- Auditors will be trustworthy.
- Auditors will act honestly and professionally.
- Auditors will act as ambassadors of the SIM3 model and its applications.
- Auditors will contribute to the community of SIM3 Certified Auditors, and seek to support each other.
- Auditors will support the CSIRT Code of Practice and adhere to its basic principles.
- Auditors will utilise and support the Traffic Light Protocol.
AUDIT & ASSESSMENT RULES
- Auditors will conduct SIM3 Audits & Assessments honestly and professionally, respecting confidentiality and trust.
- Audits must always be done by auditors in a 3rd party, independent fashion. Auditors can therefore perform a SIM3 Assessment within their own organisation, but not an Audit.
- Auditors will never accept any offering by the team they do an audit or assessment for, if that offering can be construed as bribe – especially under the local laws and/or ethics.
- Conflicts of interest in the context of audits will be avoided or made transparent to all parties involved.
* A small number of SIM3 Auditors did not want to be listed on this website, but are nonetheless Certified and in good standing. For them, you can ask OCF to verify their status.