Open CSIRT Foundation

What Open CSIRT Foundation does

Stichting Open CSIRT Foundation (OCF) is a Dutch not-for-profit foundation established on 21 October 2016 and headquartered in Zeist, the Netherlands. Its mission is to improve global cyber resilience by promoting cooperation and development of cyber security incident management. OCF is the primary intellectual property holder and steward of the SIM3 (Security Incident Management Maturity Model), a 45-parameter framework that measures the maturity of CSIRTs across governance, documentation, performance, and measurement dimensions, and which is offered free for use. SIM3 is complemented by defined baselines (TI Certification, ENISA Basic/Intermediate/Advanced/Expert, FIRST Membership, CSIRTAmericas), an online self-assessment tool with a strict no-data-collection policy, and a formal audit and assessment service delivered exclusively through independent Certified SIM3 Auditors. Since July 2022 OCF also serves as the home of TF-CSIRT, the European community of security incident management teams, and operates the Trusted Introducer team database.

OCF monetizes indirectly through: (1) fees for the official 3-day SIM3 Auditor certification training, priced at marginal overhead per the not-for-profit principle, with the first year of certification at zero cost; (2) audit-related revenues generated via certified auditors; and (3) donations and sponsorships (including NRD Cyber Security and Mnemonic). Distribution is event-driven, anchored on training delivery in Europe twice yearly plus bespoke worldwide trainings through institutional partnerships (NCA in Japan, OAS for the Americas, EU FPI Cyber4Dev, DCAF, TrustBroker Africa, CERT.br, and national ministries). The certified auditor community exceeds 350 professionals across all continents, and SIM3 is used by ENISA, FIRST, ITU, OAS, GFCE, the EU CSIRTs Network, and NCA, with NCA alone applying SIM3 to 500+ CSIRTs in Japan.

Governance is provided by an unpaid Board of Directors (Chairman Don Stikvoort, Treasurer Martijn de Hamer, Secretary Mirosław Maj, and ex-officio member Silvio Oertli as TF-CSIRT Steering Committee Chair) and a Board of Commissioners. The founding fathers — Don Stikvoort, Klaus-Peter Kossakowski, and Mirosław Maj — are also the co-creators of SIM3 and personally donated the start-up capital. There is no venture capital, private equity, or parent-company involvement. The product roadmap is centered on the SIM3 v2 full release planned for 2026, which will extend the framework beyond CSIRTs to ISACs, SOCs, and PSIRTs.

Name

Open CSIRT Foundation

Legal name

Stichting Open CSIRT Foundation

Website

https://opencsirt.org

Company type

Private

Founded year

2016

Operating status

Operating

Headcount range

1–10 employees

Short description

Open CSIRT Foundation (Stichting OCF) is a Dutch not-for-profit that develops and stewards the SIM3 maturity framework for CSIRTs, certifies SIM3 Auditors globally, and hosts TF-CSIRT and the Trusted Introducer database serving national and sectoral incident response teams worldwide.

Ownership category

akta.pro rank

Headquarters

HQ city

Zeist

HQ country

Netherlands

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Revenue model

1. SIM3 Auditor Certification Training: OCF organizes official 3-day certification trainings to become Certified SIM3 Auditors. Training fees vary by location and are calculated with marginal overhead following the not-for-profit principle. The first year of certification after passing is at zero cost.
2. SIM3 Audits and Certifications: Revenue from SIM3 audits performed by Certified SIM3 Auditors. Audits can be measurement-based, certification-based, or membership-related. Audit certificates are valid for a maximum of 3 years. Training revenues plus donations finance SIM3 maintenance and improvement.
3. Donations and Sponsorships: As a not-for-profit foundation under Dutch law, OCF accepts donations and sponsorships. Sponsors include NRD Cyber Security (Lithuania) and Mnemonic (Norway).

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels4 records

Core offering

Open CSIRT Foundation stewards the SIM3 (Security Incident Management Maturity Model) framework and provides associated services including official SIM3 Auditor certification training (3-day programs), formal SIM3 audits and assessments conducted by Certified SIM3 Auditors, SIM3 Baselines for specific contexts (ENISA, TI, FIRST, OAS), and the SIM3 Online Self-Assessment Tool. The foundation also hosts the TF-CSIRT community and Trusted Introducer database for European security incident management teams.

Product overview

Open CSIRT Foundation (OCF) is a not-for-profit foundation based in the Netherlands that focuses on improving cyber resilience worldwide through the stewardship of the SIM3 maturity model. The core offering is the SIM3 (Security Incident Management Maturity Model) framework, which measures CSIRT maturity across 45 parameters. The SIM3 portfolio includes the SIM3 Online Tool for self-assessment, formal Audits and Assessments conducted by Certified SIM3 Auditors, and SIM3 Baselines that define minimum requirements for different contexts (including ENISA, TI Certification, FIRST membership, and CSIRTAmericas baselines). OCF also organizes SIM3 Certified Auditor Training programs and hosts the 4gh security conference. Since July 2022, OCF also serves as the home to TF-CSIRT and its Trusted Introducer database. The organization operates without a public API or AI capabilities.

Differentiator

Problem solved

Functional benefit

Brands

• 4gh: A small scale trusted meeting of cyber security experts, on invite only, designed to create a trusted environment for open sharing among peers.
• SIM3
• TF-CSIRT
• Trusted Introducer

Products and services

• SIM3 Maturity Model
• SIM3 Online Self-Assessment Tool
• SIM3 Certified Auditor Training
• SIM3 Audits
• SIM3 Assessments
• SIM3 Baselines
• 4gh Conference
• Trusted Introducer

Quantifiable outcome

• SIM3 used for FIRST new membership applications
• +3 more outcomes

Named customers10 records

Segments5 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

17 partnerships are on record, tiered core and minor.

• TF-CSIRTcoreStrategic or Co-development Partner · 1 July 2022Since July 2022, OCF is the home to TF-CSIRT, the European community for cyber security incident management teams. TF-CSIRT Steering Committee member is ex officio on OCF Board of Directors.
• Trusted IntroducercoreStrategic or Co-development PartnerMembership database of teams maintained by TF-CSIRT. Used for TF-CSIRT accreditation and certification. Operated under OCF since July 2022.
• Nippon CSIRT Association (NCA)coreStrategic or Co-development PartnerMoU between OCF and NCA. NCA performs SIM3 Auditor certification trainings on behalf of OCF in Japan. NCA uses SIM3 for over 500 teams in Japan. NCA has representation in OCF governance.
• Organization of American States (OAS)coreStrategic or Co-development PartnerOAS and OCF developed CSIRTAmericas Baseline in 2024. OAS publishes baseline in English and Spanish. Conducts joint SIM3 training programs. OAS auditors listed under Latin America region.
• EU FPI Cyber4Dev ProjectminorStrategic or Co-development PartnerCooperation with EU FPI Cyber4Dev project for SIM3 trainings. Dublin, Ireland (July 2022) and Maputo, Mozambique (April 2023) trainings conducted in cooperation with this project.
• TrustBroker AfricaminorStrategic or Co-development PartnerAfrican cybersecurity initiative with certified SIM3 auditors. Cotonou, Benin training (October 2024) conducted in cooperation with TrustBroker Africa.
• WACRENminorStrategic or Co-development PartnerWest and Central African Research and Education Network with certified SIM3 auditors.
• DCAF (Geneva Centre for Security Policy)minorStrategic or Co-development PartnerFeldafing, Germany training (May 2025) conducted in cooperation with DCAF (Switzerland) and hosted by GIZ (Germany).
• Bahrain Ministry of InteriorminorStrategic or Co-development PartnerBahrain training (November 2023) conducted in cooperation with the country of Bahrain, Ministry of the Interior.
• CERT.br / nic.br (Brazil)minorStrategic or Co-development PartnerSão Paulo and Brasilia trainings (November 2025) conducted in cooperation with CERT.br and hosted by nic.br.
• ENISA (European Union Agency for Cybersecurity)coreStrategic or Co-development PartnerENISA developed SIM3 Baselines (Basic, Intermediate, Advanced, Expert) inspired by EU NIS Directive with support of OCF (2019). Used by EU CSIRTs Network for national and sectoral teams.
• FIRST (Forum of Incident Response and Security Teams)coreStrategic or Co-development PartnerOCF and FIRST together developed limited SIM3 Baseline for FIRST membership (2023). SIM3 used for new FIRST membership applications. SIM3 v2 expanded typology of four (CSIRT, ISAC, SOC, PSIRT) agreed with FIRST in 2023.
• ITU (International Telecommunications Union)coreStrategic or Co-development PartnerITU uses SIM3 as part of global cyber expertise initiatives. Pablo Palacios Ochoa listed as ITU auditor under Latin America.
• GFCE (Global Forum for Cyber Expertise)coreStrategic or Co-development PartnerGFCE adopted SIM3 for global cyber expertise. OCF contributes to GFCE initiatives.
• AfricaCERTminorStrategic or Co-development PartnerAfrican CSIRT coordination body with certified SIM3 auditors including Jean-Robert Hountomey.
• ECOWASminorStrategic or Co-development PartnerEconomic Community of West African States with certified SIM3 auditor Folake Olagunju.
• SPCSS (Czechia)minorImplementation/ SI/ Consulting PartnerPrague, Czechia training (March 2025) hosted by SPCSS.

Scale indicators5 records

Recent moves7 records

Expansion highlights5 records

Broad incumbents

• SANS Institute: SANS is a major cybersecurity training and GIAC certification provider with deep overlap in incident-handling curricula. Comparable as a global cyber-training organization, though broader in scope than OCF's SIM3 specialization.
• (ISC)²: (ISC)² administers the CISSP and other widely held cybersecurity certifications. Comparable as a global, non-profit, certification-driven organization within the cybersecurity profession.
• ISACA: ISACA delivers IT governance, risk and cybersecurity certifications (CISM, CRISC, CISA) and frameworks. Comparable as a professional certification body for security and risk practitioners, though broader than SIM3.
• ENISA (European Union Agency for Cybersecurity): ENISA developed the SIM3 Baselines (Basic, Intermediate, Advanced, Expert) with OCF support and drives EU CSIRTs Network maturity assessments under the NIS/NIS2 Directives. Comparable as a public-sector authority that operationalizes incident-response maturity standards across EU member states.

Regional players

• Organization of American States (OAS) Cyber Program: OAS co-developed the CSIRTAmericas Baseline with OCF in 2024 and jointly runs SIM3 trainings across the Americas. Comparable as a regional/multilateral body promoting CSIRT maturity in Latin America and the Caribbean.
• AfricaCERT: AfricaCERT is the African CSIRT coordination body whose network of certified SIM3 Auditors supports continental capacity building. Comparable as a regional peer organization leveraging SIM3 for cyber-incident-response maturity in Africa.

Direct peers

• Center for Internet Security (CIS): CIS publishes widely adopted security benchmarks and maturity-style controls (CIS Controls, CIS Benchmarks) used by security operations teams. Comparable as a non-profit that creates community-maintained cybersecurity standards and certifications.
• TF-CSIRT: TF-CSIRT is the European community of security incident management teams, operated under OCF since July 2022 with ex officio board representation. It runs Trusted Introducer accreditation and uses SIM3 for team certifications, making it a directly adjacent peer governance body.
• FIRST (Forum of Incident Response and Security Teams): FIRST is the global association of incident response and security teams and a strategic co-development partner of OCF: together they built the FIRST Membership SIM3 Baseline (2023), and FIRST uses SIM3 for new membership applications. Comparable as a peer-run, volunteer-governed global CSIRT community organization.
• CERT Coordination Center (CERT/CC, Carnegie Mellon): CERT/CC is one of the original CSIRTs and a foundational incident-response coordination body. Comparable as a peer institution developing best-practice guidance, training and tools for national and enterprise CSIRTs globally.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/open-csirt-foundation

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Open CSIRT Foundation