Key takeaways
- Having a PSIRT at all and having a good PSIRT are different questions, and FIRST's PSIRT Maturity Document is the tool built to answer the second one.
- The PSIRT Services Framework v1.1 answers "what should a PSIRT be doing" — it lists the service areas and the Strategic/Tactical/Operational foundation underneath them.
- Score each service area separately, not the team as a whole — a single composite "we are Level 2" statement hides exactly the gaps the document is designed to expose.
Having a PSIRT at all and having a good PSIRT are different questions, and FIRST's PSIRT Maturity Document is the tool built to answer the second one. Published by FIRST's PSIRT Special Interest Group as a companion to the PSIRT Services Framework, it walks through the same service areas the Framework defines and scores each one across three levels — Basic, Intermediate and Advanced — so a team can see exactly which part of its process is holding back the rest.
The three levels
| Level | FIRST's own tagline | What it covers |
|---|---|---|
| 1 — Basic | "The Beginning is a very fine place to start" | Executive sponsorship and a named team; a route for reports to arrive; a basic triage and analysis process; initial use of a scoring system such as CVSS |
| 2 — Intermediate | "I am reactive, but I've trained for it!" | Builds on Level 1 with a trained, more consistent process; stakeholder ecosystem management; a product/component inventory (a bill of materials); and tracked metrics on report volume and response time |
| 3 — Advanced | "Proactive...we're ready for anything (mostly)" | Builds on Levels 1-2 with proactive vulnerability discovery (not just reactive intake); deeper coordination with external researchers and industry peers; and integration of security feedback into the secure development lifecycle |
Each level is explicitly cumulative — Level 2 assumes Level 1's building blocks already work, and Level 3 assumes both lower levels are solid, so a team cannot skip the reactive basics and claim a "proactive" maturity score just because it runs a bug bounty programme without a working triage process underneath it.
The service areas it scores
The Maturity Document applies its three levels across the same service areas the PSIRT Services Framework defines: stakeholder ecosystem management, vulnerability discovery, vulnerability triage and analysis, remediation, vulnerability disclosure, and training and education. A PSIRT's overall maturity is not one single number — it is realistic, and common, for a team to be Advanced in triage and analysis while still Basic in proactive vulnerability discovery, and the document is built to surface that unevenness rather than hide it behind a single composite score.
Why this pairs with the Services Framework rather than replacing it
The PSIRT Services Framework v1.1 answers "what should a PSIRT be doing" — it lists the service areas and the Strategic/Tactical/Operational foundation underneath them. The Maturity Document answers "how well is the team doing it right now," using that same service-area structure as its scoring axis. A team setting up a PSIRT for the first time typically reads the Framework first to scope what it is building, then uses the Maturity Document to benchmark progress and plan the next investment — training, tooling or headcount — against whichever service area scores lowest.
How this fits regulatory vulnerability-handling duties
Neither the EU Cyber Resilience Act's Annex I Part II vulnerability-handling requirements nor ISO/IEC 29147 and 30111 names a FIRST maturity level as a compliance target — a product can be CRA-compliant without ever being formally scored against this document. What the levels are useful for is gap analysis: a team already building a CVD process against ISO/IEC 29147/30111 can map its current practice onto FIRST's three levels to spot where it is reactive-only (Level 1-2) versus where it has room to add proactive discovery and SDLC integration (Level 3), independent of what any single regulation strictly requires.
What a PSIRT should do with this document
Score each service area separately, not the team as a whole — a single composite "we are Level 2" statement hides exactly the gaps the document is designed to expose. Treat Level 1 as the non-negotiable floor, not an early milestone to rush past. A named owner, a working intake route and a basic triage process are what everything else depends on. Use the lowest-scoring service area to prioritise the next investment, whether that is training, a bill-of-materials tool, or a formal stakeholder-coordination process for third-party components. Re-score periodically, especially after a regulatory deadline (such as the CRA's reporting obligations) forces process changes — maturity documents are meant to be revisited, not scored once and filed away. Pair the self-assessment with a concrete build-out planSee how to set up a PSIRT for a hardware product company for the step-by-step version of reaching a working Level 1, and the CVD process guide for how the underlying ISO processes map onto these same service areas.
SoftWSP can run a PSIRT maturity assessment against these three levels and help prioritise the gap that is actually slowing your team down: see PSIRT services.
Sources
Frequently asked questions
What is the FIRST PSIRT Maturity Document?
It is a companion document to FIRST's PSIRT Services Framework, published by FIRST's PSIRT Special Interest Group, that gives a product security incident response team a way to self-assess which of three maturity levels its current practice sits at, service area by service area, rather than treating 'do we have a PSIRT' as a single yes/no question.
What are the three PSIRT maturity levels?
Level 1, titled 'The Beginning is a very fine place to start,' covers the foundational building blocks: executive sponsorship, a named team, a basic vulnerability intake and triage process, and first use of a scoring system such as CVSS. Level 2, 'I am reactive, but I've trained for it!,' assumes Level 1 is in place and adds a trained, more formal process, a product/component inventory such as a bill of materials, and tracked metrics. Level 3, 'Proactive...we're ready for anything (mostly),' assumes Levels 1 and 2 and adds proactive vulnerability discovery, deeper external stakeholder coordination, and integration with the secure development lifecycle.
How does the Maturity Document relate to the PSIRT Services Framework?
The Services Framework (current version 1.1) defines what a PSIRT does, organised into service areas such as stakeholder ecosystem management, vulnerability discovery, triage and analysis, remediation, disclosure, and training and education. The Maturity Document applies that same set of service areas and asks how well-developed each one currently is, levelled from Basic through Advanced, so the two documents are meant to be read together rather than as alternatives.
Does CRA or ISO/IEC 29147/30111 require a specific FIRST maturity level?
No. Neither the EU Cyber Resilience Act nor ISO/IEC 29147 (disclosure) or ISO/IEC 30111 (vulnerability handling) names FIRST's maturity levels or requires a specific score. The Maturity Document is a voluntary self-assessment tool a PSIRT can use to plan its own improvement; meeting CRA's Annex I Part II vulnerability-handling points or the ISO processes does not require citing a particular FIRST maturity level, though the underlying practices overlap heavily.
Can a small hardware company realistically reach Level 1?
Yes — Level 1 is deliberately scoped to what a small team can stand up: a named owner, a way to receive reports, a basic triage and scoring process, and a route to ship a fix and an advisory. FIRST's own framing of Level 1, 'the beginning is a very fine place to start,' signals it is meant as an achievable starting point, not an aspirational end state; see our guide on setting up a PSIRT for a hardware company for the concrete steps that get a small team to that point.
In this cluster
