CSIRTs

A Computer Security Incident Response Team (CSIRT) is a group that coordinates and provides response to information security incidents for information systems. CSIRTs can operate at different levels, including national, sector-specific, or organizational, and may be part of government agencies, private companies, educational institutions, or cooperative networks.

Core functions of a CSIRT include monitoring for and detecting security incidents, triaging and analyzing alerts, containing and eradicating threats, restoring normal operations, and conducting post-incident reviews to identify lessons learned. They also develop and share guidance such as advisories, bulletins, and recommendations, coordinate vulnerability handling and responsible disclosure with software vendors, and provide threat intelligence to help prevent future incidents. In addition, CSIRTs often engage in capacity building, run awareness programs, and offer incident response training.

CSIRTs serve as points of contact for organizations and partners, and they frequently collaborate with other CSIRTs, CERTs, vendors, academic researchers, and law enforcement. They work within formal governance structures and may publish playbooks, procedures, and service level expectations to guide incident handling.

Types of CSIRTs include national CSIRTs, sectoral or regional CSIRTs, and organizational CSIRTs, each contributing to a broader national or international incident response ecosystem. They commonly participate in international forums and networks to share indicators, best practices, and coordinated response efforts.

The CSIRT concept originated from the first CERT at Carnegie Mellon University in 1988 and has since evolved into a global network coordinated by groups such as FIRST and regional bodies, with national agencies often supported by EU bodies like ENISA. Examples include US-CERT, CERT-EU, CERT-In, and CERT NZ.