InCommon will host its fifth annual Security Incident Response Trust Framework for Federated Identity (Sirtfi) cybersecurity cooperation exercise this fall, from Nov. 16-20, 2026.
Sirtfi-compliant organizations interested in having their federated identity providers (IdPs) and/or service providers (SPs) participate in this exercise should respond to the Call for Participation by Oct. 2, 2026.
REFEDS Sirtfi is part of InCommon’s baseline expectations, and this event supports increasing cross-federation levels of trust in cybersecurity.
The event is open to InCommon participants and eduGAIN partners, who will practice coordinating a response to a federated security incident by participating in a multi-organization, federated incident response tabletop exercise.
Practicing the Sirtfi Framework
The exercise’s primary purpose is to practice using the Sirtfi framework to coordinate cybersecurity incident response between affected organizations. InCommon’s goals include practicing cross-organization coordination on cybersecurity scenario response using the Sirtfi Framework and identifying when to get — and how to get — the published security contact to provide an incident notification.
Participants will practice communication and coordination with other federated teams in a distributed tabletop scenario. This is not a technical exercise, and there will be no live action on any network.
All breaches, security investigations, and log files will be simulated in a story-driven narrative. The nature of the scenario will generate discussion on pertinent security and fraud issues relevant to the research and education community today.
How the Exercise Will Work
Participants will perform four “real-world” tasks as they discuss the narrated scenario and interact with the exercise control cell coordinated by the Sirtfi Exercise Working Group:
- Recognize when the scenario includes activity that affects other external federated organizations, which prompts the need to use the Sirtfi framework.
- Find a user’s security contact when given a username/organization, as required by the Sirtfi framework.
- Establish communications with an external organization using the Sirtfi security contact.
- Receive and respond to requests from the security contact, identify those requests as Sirtfi requests, and partner as appropriate depending on the narrated scenario event.
All other tasks will be simulated through tabletop narration. Additional information is available on the working group wiki.
This cybersecurity cooperation exercise enables institutions to practice what they committed to doing when they asserted Sirtfi compliance. Practicing is preferable to waiting for a real security breach to figure Sirtfi out while also under the pressure of trying to secure your network.
We hope you’ll join us for this year’s exercise.
About the Sirtfi Exercise Working Group
The Sirtfi Exercise Working Group prepares members of the InCommon Federation community to handle a federated security incident by conducting one or more tabletop exercises to simulate aspects of responding to the real thing.
Exercises are designed as learning opportunities that increase familiarity with and shared understanding of key concepts and practices in the Sirtfi framework. The Sirtfi Exercise Working Group is chartered by the InCommon Community Trust and Assurance Board.
