Following a discussion amongst the CSIRT community during the ‘51st TF-CSIRT meeting’ (15 May 2017 in The Hague, Netherlands), it was concluded that there is an urgent need for a taxonomy list and name that serves as a fixed reference for everyone. This is why ENISA and TF-CSIRT created the ‘Reference Security Incident Taxonomy Working Group". The aim of this working group is to enable the CSIRT community in reaching a consensus on a reference taxonomy.

Reference Security Incident Taxonomy Working Group was approved as official TF-CSIRT working group by the TF-CSIRT Steering Committee on 26 September 2018.

To become part of the working group, the requester should send an email to ENISA secretariat [email protected] or sign up for a physical meeting during a TF-CSIRT event. In case of physical meeting, please notify in presence to the ENISA secretariat or via email the request for addition to the mailing list.

You may suggest additions to the taxonomy via GitHub's pull request mechanism. These pull requests will be discussed at the next TF-CSIRT event and merged - provided they achieve group consensus. See also the Terms of Reference.

During the 2nd meeting at 53rd TF-CSIRT in Hamburg it was decided to use eCSIRT.net as starting point and use as it is for version 1.

For more info visit the ENISA working document (https://www.enisa.europa.eu/publications/reference-incident-classification-taxonomy).

Check the TF-CSIRT meeting page https://tf-csirt.org/tf-csirt/meetings/ to register for the next upcoming meeting.