# CIR, Cyber Issue Record

> CIR is an open YAML format that describes a security issue once, for public vulnerabilities and internal findings alike. A record has four layers (core, threat_intel, posture, context), each with its own TLP, so it is shared by dropping the layers an audience may not see. Scores (cir-risk/0.1) are computed from the record, never typed in.

CIR references existing standards (CVE, GHSA, OSV, CVSS, CWE, EPSS, CISA KEV, MITRE ATT&CK, VEX, TLP 2.0) instead of redefining them. Status: draft v0.5, fields may still change.

Identifiers are CIR-YYYY-CODE-NNNN. CODE starting with 0 is a registered public authority (00 = root), starting with 1 is a public mirror generated from an external database (CVE-2021-44228 is CIR-2021-1CVE-44228), anything else is an organization's internal code. An internal record points to a public one with meta.based_on and adds only its posture and context.

## Start here

- [CIR by example](https://cirsec.org/llm/example.md): the concept, identifiers, three annotated records, common tasks and the rules not to break

## Specification

- [CIR specification (Markdown)](https://cirsec.org/spec.md): every field, enum, validation rule and the scoring method
- [Authorities registry](https://github.com/cirsec/spec/blob/main/authorities.yml): issuer codes allowed in public record IDs
- [Full template](https://github.com/cirsec/spec/blob/main/cir.yml): a record with every field

## Example records

- [CIR-2021-00-0001](https://cirsec.org/assets/examples/CIR-2021-00-0001.yml)
- [CIR-2021-GRP-0003](https://cirsec.org/assets/examples/CIR-2021-GRP-0003.yml)
- [CIR-2026-LAB-0012](https://cirsec.org/assets/examples/CIR-2026-LAB-0012.yml)

## Pages

- [CIR · Cyber Issue Record](https://cirsec.org/): CIR is an open YAML format that describes a security issue once, in four layers with their own TLP, so every team and every partner reads the same record.
- [About · CIR](https://cirsec.org/about): CIR is an open project carried by Hack in the Shell, a French non-profit association, to make cybersecurity and vulnerability management clear, usable and accessible.
- [Authorities · CIR](https://cirsec.org/authorities): The registry of CIR public authorities: the issuer codes allowed to publish public CIR records, and how to get one.
- [Record builder · CIR](https://cirsec.org/builder): Write a CIR record in a form instead of YAML: every field of the spec, live checks and scores, export by TLP. Import and export stay in your browser.
- [Changelog · CIR](https://cirsec.org/changelog): Every version of the CIR format, newest first, with breaking changes marked and what to do about them.
- [Contribute · CIR](https://cirsec.org/contribute): How to report what does not fit, propose a change to the CIR specification, become a public authority, and how versions work.
- [Examples · CIR](https://cirsec.org/examples): Three annotated CIR records: a public CVE (Log4Shell), an internal record extending it, and a pentest finding with no CVE, each with its score worked out.
- [FAQ · CIR](https://cirsec.org/faq): Questions about CIR: how it relates to CVE, CVSS, OSV, VEX and STIX, why YAML, why scores are computed, who maintains the format and how versions work.
- [Legal notice and privacy · CIR](https://cirsec.org/legal): Legal notice of cirsec.org, published by the French association Hack in the Shell, and its privacy policy: no cookie, no tracker, records you write stay in your browser.
- [CVE mirror · CIR](https://cirsec.org/mirror): Every CVE already has a CIR: CVE-2021-44228 is CIR-2021-1CVE-44228, generated on demand from public sources. Look one up or extend it with based_on.
- [Scoring · CIR](https://cirsec.org/scoring): cir-risk/0.1, the CIR scoring method: four inputs of 0 to 3 points, a public priority and an organizational risk, never typed in. With a calculator.
- [Sharing · CIR](https://cirsec.org/sharing): How a CIR record is shared: one TLP per layer, exports that drop what an audience may not see, and a posture layer a CERT can aggregate safely.
- [Specification · CIR](https://cirsec.org/spec): The CIR v0.5 field-level specification: identifiers, TLP rules, the core, threat_intel, posture and context layers, and the cir-risk scoring method.

## Optional

- [Everything in one file](https://cirsec.org/llms-full.txt): the specification followed by every example record