Trusted Introducer

Trusted Introducer
Name	Trusted Introducer
Type	Accreditation and assurance service
Founded	2000
Region	Europe

Trusted Introducer

Trusted Introducer was a European accreditation and assurance service for computer security incident response teams that linked national CERTs, governmental agencies, and academic institutions. The project connected organizations such as RIPE NCC, FIRST, ENISA, NIS Directive, Europol and Council of Europe while engaging technical communities like JANET, SURFnet, DFN, TERENA and NORDUnet.

Overview

Trusted Introducer operated as a peer-review and accreditation framework serving incident response teams, coordinating between entities such as CERT/CC, UK Cabinet Office, National Cyber Security Centre (UK), INCIBE, and ANSSI. The service provided listings, accreditation reports, and liaison functions that involved cooperation with European Commission, NATO Cooperative Cyber Defence Centre of Excellence, ITU, OECD, OSCE and a range of university research groups at University of Cambridge, TU Darmstadt, ETH Zurich, University of Oxford, KU Leuven.

History and Development

Trusted Introducer emerged in the early 2000s amid initiatives like Budapest Convention on Cybercrime, eEurope 2002, and responses to incidents involving Morris worm, Code Red worm, Blaster worm, Conficker, and high-profile compromises affecting Yahoo!, Microsoft, Sony. Founders and supporters included actors from RIPE NCC, JISC, NLnet, UKOLN, DFN-CERT, CERT.be, and policy stakeholders such as European Parliament, European Council, and Member States of the European Union. The program evolved alongside initiatives by FIRST, SANS Institute, NIST, CERT Coordination Center, and national CERT establishments like US-CERT and CERT-EU.

Purpose and Services

Trusted Introducer aimed to increase trust among teams like CERT.at, CERT.PL, CERT.GOV.PT, CERT.lv, CERT-SE, CERT-FR by providing accreditation, published contact details, and assurance reports referenced by cybersecurity, incident response, vulnerability handling, and information sharing communities including researchers at ENISA Threat Landscape projects, analysts at Kaspersky Lab, Mandiant, Symantec, and law enforcement partners such as Europol EC3, FBI and Interpol. Services included peer review processes, code of conduct alignment with organisations like FIRST and training liaison with SANS Institute, CREST, GIAC, ISC2, and cooperation platforms such as MISP and STIX/TAXII implementations.

Membership and Accreditation

Membership processes evaluated teams from national, regional, sectoral, and corporate responders such as Vodafone, Telefonica, Deutsche Telekom, BT Group, and academic teams from Imperial College London and École Polytechnique. Accreditation criteria drew on best practices from ISO/IEC 27001, ISO/IEC 20000, and guidance from ENISA, NIST Special Publication 800-61, and standards-consortium actors including IETF and IEEE. Peer reviewers often came from established teams like CERT.at, CERT.be, US-CERT, JPCERT/CC, AUSCERT, CERT NZ, and private-sector incident responders such as FireEye, CrowdStrike, Palo Alto Networks.

Governance and Funding

Trusted Introducer operated with governance input from organizations including RIPE NCC, JISC, SURFnet, DFN, NLnet, and advisory engagement with European Commission DG CONNECT, ENISA, NATO CCDCOE, and national ministries such as UK Home Office, Bundesministerium des Innern, Ministry of the Interior (Netherlands). Funding and sponsorship came from a combination of sources including grants from European Commission, membership fees, and support from foundations like Steering Committee of the RIPE NCC partners and research programmes such as FP7 and Horizon 2020 collaborations.

Impact and Criticism

Trusted Introducer influenced capacity building among teams such as CERT.lv, CERT.CZ, CERT.ro, CERT.bg, and fostered interoperability with platforms like FIRST and ENISA-CSIRT Network, while informing policy dialogues in forums like European Parliament Committee on Civil Liberties, Justice and Home Affairs and Council of the European Union. Critics referenced concerns about sustainability raised in contexts involving public–private partnership debates, resource constraints echoed in discussions around Horizon 2020 funding cycles, and questions of scope compared with initiatives like FIRST and national efforts including US-CERT and NCSC UK. Evaluations compared its peer-review approach to accreditation models such as ISO/IEC schemes and drew attention from academics at University College London, Delft University of Technology, University of Twente, and policy analysts at Chatham House.

Category:Computer security organizations