CSIRT: meaning

In short

The word refers to two different things. A company CSIRT is the internal team, supported by any suppliers, that responds when a company suffers an incident. A national CSIRT is the public body that collects reports and coordinates the response at country level: in Italy it is CSIRT Italia, part of ACN, Italy's National Cybersecurity Agency, which also receives the notifications required by NIS2. CERT is a historical term often used as a synonym.

How it works

A company CSIRT is not made up of technicians alone. It usually includes:

• an incident manager, who coordinates and sets priorities;
• technical leads for systems, network and applications, together with the IT suppliers;
• whoever covers legal and privacy matters, including the DPO if one has been appointed;
• whoever handles communication with employees, customers, authorities and the press;
• a management representative, who authorises decisions with a business impact.

The work follows a well-known cycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned. The most important part is the first: roles, contacts and procedures are decided beforehand, not during the emergency.

Why it matters

During an incident time is short and decisions are weighty: whether to shut down the servers, whether to tell customers, whether to notify the Garante (the Italian Data Protection Authority) within the 72 hours set for a data breach. If nobody knows who decides, precious hours are lost. The CSIRT is also the counterpart of the SOC: the SOC detects and reports, the CSIRT takes charge and handles.

Standards require it explicitly: NIS2 requires incident handling and notification within tight deadlines, ISO/IEC 27001 requires documented response procedures.

Example

One Monday morning the management system does not respond and encrypted files appear on the servers. The incident manager convenes the CSIRT that has already been defined: the technician isolates the machines, the IT supplier checks the backups, the privacy lead assesses whether personal data is involved, management approves the message to customers. Every action is logged with the name of whoever takes it. When the incident is over, the same record is used for the notification and to understand what to change.

Related terms

• SOC
• Ransomware
• Business continuity
• TLP: how information is shared during an incident