Method
DFIR Readiness Benchmark Harness
Can the team prove incident response readiness with repeatable benchmarks?
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| Scenario | text | context | context | no |
| Tabletop exercise evidence | select | evidence_signal | higher_is_better | yes |
| Telemetry replay test | select | evidence_signal | higher_is_better | yes |
| Evidence acquisition benchmark | select | evidence_signal | higher_is_better | yes |
| Containment/recovery timing evidence | select | evidence_signal | higher_is_better | yes |
| Lessons learned closeout | select | evidence_signal | higher_is_better | yes |
| Coverage metrics | select | evidence_signal | higher_is_better | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.