Security Incident Response 2.0 (2026)

… core components can be supplied: - The delivery and/or use of hardware and software for the execution of parts of this Assignment. In doing so, the Contractor takes into account the standards and/or installed base used by the Participant. - Training courses: If necessary, the Participant may request the Contractor to perform or take care of train-in-gen. In addition to these core components, the following are also part of the scope. - Strategic and technical advice: Strategic and technical advice on incident handling. Think of advice on paying compensation in case of attacks/ransomware. Or strategic advice on policy on these topics. - Communication advice; advice on communication strategies and advice on communication in the event of specific incidents. This could include assisting the Institution in drawing up communiqués and/or translating technical matters into comprehensible language in support of general communication to the outside world. This can also include additional reporting activities, such as advising on how reports can be shared with the (SURF) communities and/or third parties or making contributions to presentations in which results are shared. - Conversation on behalf of the Institution on the security incidents with ‘evil actors’. Other ways of sharing knowledge within and outside the Institutions/community, such as the input of knowledge and expertise in exercises, redteaming and training to strengthen cooperation within the process of incident response. Each incident response request may include one or more of the listed tasks, but does not need to include all of them. For example, when an incident takes place, the institution can invoke the ‘defence and mitigation’, but it can itself provide for the coordination of the activities. Other combinations of parts of the assignment can also be assigned to the contractor by the Institution.