IICTI Certified CSIRT Maturity & Security Incident Management Lead Auditor

Holders demonstrate that they can apply and evaluate advanced CSIRT Governance, Mandate, Constituency & Accountability, sIM3 Framework Architecture, Parameters & Maturity Dimensions, cSIRT Organizational, Human, Tools & Process Maturity Assessment and cSIRT Service Portfolio, Operating Models & Capability Assurance, plus 20 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for CSIRT Maturity & Security Incident Management Lead Auditor.

Who it is for: Professionals working, or preparing to work, in audit, risk & governance roles.

1. 01Advanced CSIRT Governance, Mandate, Constituency & Accountability4% of the exam

   • Assess whether a CSIRT's mandate, constituency, authority and accountability arrangements are formally established, aligned with practice and defensible to governance and regulators.
   • Scope: CSIRT mandate and charter approval, constituency definition, authority models (full, shared, none), RFC 2350 descriptors, reporting lines, funding, governance escalation and accountability when services are outsourced.
2. 02SIM3 Framework Architecture, Parameters & Maturity Dimensions5% of the exam

   • Evaluate a CSIRT against the SIM3 model, interpreting each parameter category and maturity level correctly and distinguishing model requirements from local practice.
   • Scope: SIM3 structure (Open CSIRT Foundation): Organisation, Human, Tools and Processes categories, maturity levels 0 to 4, parameter semantics, version differences, and links to Trusted Introducer certification and ENISA CSIRT maturity tiers.
3. 03CSIRT Organizational, Human, Tools & Process Maturity Assessment4% of the exam

   • Assess organisational, human, tools and process maturity of a CSIRT holistically, identifying cross-category dependencies and weaknesses that a single-parameter view would miss.
   • Scope: Assessment of organisational framework, staffing, skills, training and resilience, tooling (ticketing, resilient communications, detection) and documented processes across the O, H, T and P categories, including dependencies between them.
4. 04CSIRT Service Portfolio, Operating Models & Capability Assurance4% of the exam

   • Evaluate whether a CSIRT's declared service portfolio and operating model are coherent, resourced and evidenced as deliverable capabilities.
   • Scope: FIRST CSIRT Services Framework v2.1 service areas, service descriptions and SLAs, internal, outsourced, MSSP and hybrid operating models, SOC and CSIRT interfaces, and assurance that declared services are actually deliverable.
5. 05CSIRT Maturity Benchmarking, Target Profiles & Continuous Improvement4% of the exam

   • Design realistic target maturity profiles and improvement programmes and evaluate whether benchmarking comparisons are methodologically valid.
   • Scope: Maturity benchmarking against peers, ENISA tiers and Trusted Introducer thresholds, target profile definition, risk-based prioritisation of gaps, SOC-CMM comparison, PDCA and continual improvement tracking over successive assessments.
6. 06SIM3 Parameter-Level Assessment, Scoring & Evidence Validation5% of the exam

   • Lead parameter-level SIM3 scoring decisions and validate that each score is supported by sufficient, reliable and traceable evidence.
   • Scope: Parameter-by-parameter SIM3 scoring, distinguishing implicit, explicit internal, formalised and assessed levels, sufficiency and authenticity of evidence, documented versus practised controls, and justification of every awarded score.
7. 07Advanced Risk-Based CSIRT Audit Planning & Assessment Methodology4% of the exam

   • Design risk-based CSIRT audit plans that allocate effort to the highest-risk parameters and processes within agreed objectives, scope and criteria.
   • Scope: Risk-based audit programme and plan design per ISO 19011 and ISO/IEC 27007, scope, criteria and objectives, pre-assessment and document review, audit team selection, time allocation, remote and on-site methods and logistics.
8. 08Auditor Calibration, Scoring Consistency & Inter-Assessor Reliability4% of the exam

   • Lead calibration and moderation activities that keep maturity scores consistent and reproducible across assessors and assessments.
   • Scope: Calibration workshops, anchor cases and scoring guides, inter-rater reliability measures (Cohen's and Fleiss' kappa, percentage agreement), assessor drift, moderation and consensus rules, and quality review of scores.
9. 09CSIRT Audit Evidence, Interviews, Sampling & Technical Verification5% of the exam

   • Audit CSIRT capabilities by collecting, sampling, triangulating and technically verifying evidence so that conclusions are reliable and reproducible.
   • Scope: Document review, structured interviews, observation and walk-throughs, ticket and log sampling (judgemental and statistical), triangulation, technical verification of tools and reachability, and audit trail of evidence.
10. 10SIM3 Maturity Gap Analysis, Findings, Reporting & Remediation Roadmaps4% of the exam

    • Design audit findings, reports and remediation roadmaps that are evidence-based, prioritised by risk and verifiable at follow-up.
    • Scope: Gap analysis against target profiles, finding statements (criteria, condition, cause, effect), grading, root cause, report structure and fair presentation, remediation roadmaps, sequencing and follow-up verification.
11. 11Advanced Security Incident Management Governance & Lifecycle Auditing5% of the exam

    • Audit the governance and end-to-end lifecycle of security incident management against recognised standards and the organisation's own policy.
    • Scope: Incident management policy and lifecycle per ISO/IEC 27035-1/-2:2023 and NIST SP 800-61r3 with CSF 2.0, roles, escalation to legal, communications and governance, lessons learned, and lifecycle audit trails.
12. 12Threat Detection, Triage, Classification & Escalation Capability Assessment4% of the exam

    • Assess whether detection, triage, classification and escalation are consistent, timely and aligned with defined criteria and obligations.
    • Scope: Detection sources and use cases, triage criteria, incident classification and prioritisation (including the Reference Security Incident Taxonomy), severity matrices, escalation thresholds, TLP handling and regulatory reportability decisions.
13. 13Incident Containment, Eradication, Recovery & Response Effectiveness Auditing4% of the exam

    • Audit containment, eradication and recovery activities and evaluate whether response decisions were effective, authorised and adequately evidenced.
    • Scope: Containment strategies and decision authority, eradication validation, recovery and restoration criteria, reinfection monitoring, coordination with IT operations, and measurement of response effectiveness from case records.
14. 14Digital Forensics, Evidence Integrity & Incident Investigation Readiness4% of the exam

    • Evaluate a CSIRT's forensic readiness and the integrity of its evidence handling against ISO/IEC 27037 and legal admissibility expectations.
    • Scope: Forensic readiness, ISO/IEC 27037 identification, collection, acquisition and preservation, chain of custody, volatile data, hashing, cloud and endpoint evidence, legal admissibility and forensic toolset validation.
15. 15Cyber Crisis Management, Business Continuity & Major Incident Coordination4% of the exam

    • Assess whether cyber crisis and major incident coordination arrangements enable timely, authorised decisions and continuity of critical services.
    • Scope: Crisis management structures and activation criteria, ISO 22361 and ISO 22301 interfaces, major incident coordination, executive decision-making, crisis communications, EU-level crisis cooperation and continuity of CSIRT operations.
16. 16SOC/CSIRT Technical Capability Maturity, SIEM, EDR, XDR & Threat Intelligence4% of the exam

    • Evaluate the technical detection and intelligence capabilities of a SOC or CSIRT using evidence of coverage, data quality and validated effectiveness.
    • Scope: SIEM, EDR and XDR coverage and data quality, log source completeness, MITRE ATT&CK coverage mapping and validation, threat intelligence lifecycle and sharing, SOC-CMM technology and services capability.
17. 17SOAR, AI-Assisted Incident Response & Security Automation Assurance4% of the exam

    • Assess whether security automation and AI-assisted response are governed, tested, explainable and safe to operate.
    • Scope: SOAR playbook governance and change control, automated action safeguards, human-in-the-loop approvals, AI and LLM-assisted triage risks (hallucination, prompt injection, data leakage), logging and accountability of automated decisions.
18. 18Cloud, Hybrid, Third-Party & Supply Chain Incident Response Maturity4% of the exam

    • Evaluate incident response maturity across cloud, hybrid, third-party and supply chain dependencies, including contractual and technical readiness.
    • Scope: Cloud shared responsibility in incident response, log availability and retention, cloud forensic acquisition, supplier and MSSP notification clauses, NIS2 and DORA third-party requirements, SBOM and coordinated vulnerability disclosure.
19. 19Cyber Exercises, Tabletop Simulations, Purple Teaming & Operational Readiness4% of the exam

    • Evaluate whether exercise programmes validate operational readiness and drive measurable improvements in incident response capability.
    • Scope: Tabletop, functional and full-scale exercises, exercise objectives and evaluation criteria, purple teaming with ATT&CK, threat-led testing (TIBER-EU, DORA TLPT), after-action reports and improvement tracking.
20. 20Incident Metrics, KPIs, Performance Measurement & Maturity Analytics4% of the exam

    • Evaluate incident metrics and KPIs for validity, reliability and fitness as evidence of performance and maturity.
    • Scope: Definition and timestamp semantics of MTTD, MTTA, containment and recovery times, median versus mean, SLA adherence, false positive rates, metric gaming, data quality and use of metrics as maturity evidence.
21. 21CSIRT Regulatory Compliance, NIS2, ISO/IEC 27035 & International Framework Mapping4% of the exam

    • Audit CSIRT and incident management compliance with NIS2, DORA and related frameworks and design defensible cross-framework mappings.
    • Scope: NIS2 CSIRT requirements and Article 23 notification stages (24 hours, 72 hours, one month), DORA major ICT incident reporting, GDPR breach interface, ISO/IEC 27035, NIST CSF 2.0 and mapping of controls across frameworks.
22. 22Advanced Lead Auditor Competence, Ethics, Independence & Quality Assurance4% of the exam

    • Lead audit teams with demonstrable competence, ethics, independence and quality assurance, resolving conflicts and ethical dilemmas correctly.
    • Scope: ISO 19011 principles of auditing, ISO/IEC 17021-1 impartiality, conflicts of interest, confidentiality and TLP obligations, ethical dilemmas, audit team leadership, quality review and claims about OCF or Trusted Introducer status.
23. 23End-to-End SIM3-Based CSIRT Maturity Audit Practicum & Assessment Reporting4% of the exam

    • Lead a complete SIM3-based CSIRT maturity audit from planning to reporting and follow-up, producing defensible and actionable conclusions.
    • Scope: Integrated end-to-end SIM3-based audit practice: opening meeting, evidence collection, scoring, closing meeting, report drafting, dispute handling, executive summaries, follow-up and re-assessment.
24. 24Expert Auditor Examination, Practical Competency Validation & Certification Decision4% of the exam

    • Evaluate expert auditor competence evidence and certification decisions against ISO/IEC 17024 principles of validity, fairness and impartiality.
    • Scope: ISO/IEC 17024 personnel certification requirements, job task analysis, examination validity and reliability, cut scores, practical competency rubrics, certification decision impartiality, appeals, surveillance and recertification.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner