CSIRT

A Computer Security Incident Response Team (CSIRT) is a permanently established unit responsible for detecting, handling and coordinating IT security incidents. It receives reports of potential incidents, assesses their severity and impact (triage), initiates containment and recovery measures, and documents the entire course of an incident. The terms CERT (Computer Emergency Response Team) and IRT (Incident Response Team) are used synonymously; CSIRT has become the prevailing term in European and governmental usage.

A CSIRT combines technical, organisational and communication-related tasks. Technically it performs analysis, forensics and damage limitation; organisationally it manages escalation paths, roles and interfaces with business units, management, service providers and authorities; in terms of communication it is responsible for situational reports, notifications and, where applicable, press communication. The CSIRT is therefore the operational core of the incident response process and closely interlinked with emergency management, the ISMS and vulnerability management. In larger organisations it often works alongside a Security Operations Center (SOC) that handles continuous monitoring.

In a regulatory context, CSIRTs have gained considerable importance through the NIS2 Directive and its national transposition. Member States designate national CSIRTs that serve as the central point of contact for incident reports from essential and important entities, disseminate early warnings and support cross-border coordination within the CSIRTs Network. In Germany, the BSI fulfils a central CSIRT role through CERT-Bund. Affected companies, in turn, must maintain effective structures to meet the statutory reporting deadlines and to cooperate with the competent CSIRT.