About
An open standard, carried by a non-profit.
CIR is carried by Hack in the Shell, a French association. We work to make cybersecurity, and the management of vulnerabilities in particular, clear, usable and accessible.
01
What we work for
i.
Clear
One record says what an issue is, who exploits it and what was decided, in words every team can read, from the SOC to the board.
ii.
Usable
Plain YAML, computed scores, sharing by TLP. A record can be validated, scored and exported by a tool, not only read by a human.
iii.
Accessible
Open specification, free tools, no account. A small team should manage its vulnerabilities as well as a large one, without buying a platform first.
02
Who carries it
- Association
- Hack in the Shell, a French association, SIREN 928 957 679. Our website is hackintheshell.org.
- Specification
- Open under Apache 2.0 on github.com/cirsec/spec. Changes go through pull requests reviewed by the maintainers.
- Independence
- CIR references existing standards (CVE, CVSS, CWE, KEV, EPSS, ATT&CK, TLP) instead of competing with them, and ties no record to a vendor.