CSIRT

What is a CSIRT?

A CSIRT (Computer Security Incident Response Team), often also called a CERT (Computer Emergency Response Team), is a team that receives, analyses, handles and coordinates security incidents for a defined constituency, and warns and advises that constituency to prevent new incidents. The constituency can be a single organisation, a sector, a country or the customers of a product. CSIRT is the generic term; CERT is the older name, registered as a mark of Carnegie Mellon University. A CSIRT works for IT and increasingly also for OT: the control systems of factories, pumping stations and power grids. Since NIS2 and the Dutch Cybersecurity Act, the CSIRT is also a legal role: it is the point of contact where essential and important entities report their significant incidents.

🧠 Where do the terms CERT and CSIRT come from?

The first team of this kind was formed in November 1988, after the Morris worm crippled thousands of computers on the internet of the time. At the request of the US defence research agency DARPA, the Software Engineering Institute at Carnegie Mellon University set up the CERT Coordination Center (CERT/CC). That first “Computer Emergency Response Team” became the model for teams around the world, and many of them adopted the name. In 1990 FIRST (Forum of Incident Response and Security Teams) followed: the global network in which incident teams get to know and trust each other.

Because Carnegie Mellon registered CERT as a mark, other teams had to ask permission to use the name. That was a main reason for the need for an unbranded term, and it became CSIRT; Carnegie Mellon itself also recommends CSIRT as the generic term. According to Carnegie Mellon, CERT is no longer an acronym but only a mark. In June 1998, RFC 2350 set out what the outside world may expect from such a team. The RFC defines a CSIRT as a team that performs, coordinates and supports the response to security incidents within a defined constituency. It also contains a template that a team uses to publish whom it serves, how you can reach it and which services it offers. Many European CSIRTs still publish this RFC 2350 profile on their website.

Carnegie Mellon no longer grants new licences for the CERT name outside the United States; teams elsewhere have to clear the name with their own trademark counsel. Large government teams have also changed their names. In the Netherlands, GOVCERT.NL, the central government CERT founded in 2002, became part of the NCSC on 1 January 2012. In the United States, CISA retired the US-CERT and ICS-CERT names on 24 February 2023; the industrial control system advisories that many OT engineers rely on have been published under the CISA name since then.

🔄 What is the difference between a CSIRT and a CERT?

Functionally, a CSIRT and a CERT do the same work. The difference lies in the name: CERT is a registered mark of Carnegie Mellon University, while CSIRT is the generic, unbranded term. That is why RFC 2350, ENISA and the NIS2 Directive consistently use the word CSIRT.

The name therefore says nothing about size or about public versus private status. CERT-WM, for example, is a statutorily designated CSIRT just like the NCSC, despite carrying “CERT” in its name. The difference from a SOC is more fundamental: a SOC monitors continuously and raises alerts, while a CSIRT takes over as soon as an alert turns out to be an incident. In smaller organisations, both functions often sit in one team.

🎯 Which services does a CSIRT provide?

The FIRST CSIRT Services Framework (version 2.1, November 2019) is the international reference for what a CSIRT can offer. It groups services into five areas; no single team provides all of them.

During an incident, the team usually follows the cycle from NIST SP 800-61. Revision 2 (2012) described four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Revision 3 was published in April 2025 and maps incident response to the six functions of NIST CSF 2.0, from Govern to Recover. The international counterpart is the ISO/IEC 27035 series, whose parts 1 and 2 were revised in 2023.

🧱 What types of CSIRT are there?

• National CSIRT - a country’s point of contact in the European CSIRTs network; in the Netherlands this is the NCSC, which absorbed the former GOVCERT.NL
• Sector CSIRT - serves one sector, such as CERT-WM for the 21 Dutch water boards or Z-CERT for healthcare (founded in 2017)
• Organisational CSIRT - the internal team of a company such as a bank or energy utility, often linked to its own SOC or OT SOC
• PSIRT - a product security incident response team at a manufacturer, which handles vulnerabilities in its own products; essential at vendors of ICS components such as Siemens
• Commercial CSIRT service - an external provider delivering incident response on call, often under a retainer

The quality of a team can be measured. In Europe, Trusted Introducer, a service of the TF-CSIRT community, has three levels: Listed, Accredited and Certified. Certification is based on the SIM3 maturity model, which rates more than forty parameters in four categories (organisation, human, tools and processes) on a scale from 0 to 4, and is valid for three years.

⚖️ What does the law say about CSIRTs?

NIS2 requires every EU member state to designate one or more CSIRTs covering all sectors in its annexes (Article 10). Article 11 sets requirements for such a team: highly available communication channels without a single point of failure, secure sites, confidentiality, enough staff to be available at all times, and redundant systems and backup working space. Its tasks include monitoring, early warnings, incident response, forensic analysis, proactive scanning of networks on request, and acting as coordinator for coordinated vulnerability disclosure. Together, the national CSIRTs form the CSIRTs network, for which ENISA provides the secretariat.

In the Netherlands this is implemented in the Cybersecurity Act (Cyberbeveiligingswet) and the Cybersecurity Decree, which entered into force on 15 August 2026. The NCSC is the CSIRT for most sectors, and CERT-WM for the water boards. For healthcare, Z-CERT is intended to be designated; until then the NCSC acts in that role. Under the reporting obligation you report a significant incident through MijnNCSC: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The CSIRT gives an initial response to the early warning without undue delay and, where possible, within 24 hours. Since 11 September 2026, CSIRTs also receive manufacturers’ reports under the Cyber Resilience Act through the ENISA single reporting platform.

A CSIRT is not a supervisory authority. It helps, warns and coordinates; supervision lies with other bodies, depending on the sector.

🏭 How does a CSIRT work in an OT environment?

A production environment plays by different rules than an office. An IT reflex such as “pull the cable” can blind a SCADA system or stop a batch process halfway. An OT-aware CSIRT therefore works with operations and engineering, and takes these differences into account:

• Safety comes first - containment must not create a hazardous process state; the operator and the person responsible for process safety share in the decision
• Availability leads - shutting down a production line often costs more than the incident itself; isolating at the boundaries of the zones and conduits model is usually better than switching off, which requires good network segmentation in advance
• Limited visibility - PLCs and RTUs log very little; passive monitoring of network traffic and good logging on engineering workstations are often the most important sources
• Vendors are indispensable - restoring project files and firmware requires the system integrator or manufacturer, which has to be arranged contractually in advance
• Recovery needs validation - restoring a controller from a backup is only finished when the process engineer has verified its operation

Many critical infrastructure organisations (energy, water and transport) therefore run a hybrid team with OT expertise. Attacks such as Industroyer and TRITON show that a CSIRT without knowledge of the physical process cannot judge how severe an incident is. NIST SP 800-82 and IEC 62443-2-1 provide guidance for incident response in OT as part of Defense in Depth and the wider security architecture. Within the organisation itself, the CSIRT ties in with the CSIR measures: the set of arrangements a company uses to prepare for and handle incidents.

🔧 How do you set up a CSIRT function?

A mid-sized organisation does not necessarily need an in-house team of ten people. A workable approach in six steps:

1. Define the constituency and mandate - which systems (IT, OT or both) and which powers; may the team isolate a production network, and who decides?
2. Choose the model - internal team, shared with a SOC, or an external service on retainer; agree response times, for example acknowledgement within one hour and on site within four hours
3. Write the incident response plan - with roles, escalation criteria, OT-specific playbooks and the statutory reporting deadlines
4. Arrange the contacts - the sector CSIRT, the supervisory authority, vendors, the insurer and a crisis communication plan for staff and customers
5. Get the basics right - an up-to-date asset inventory, central logging and tested backups; without these three, no team can work quickly
6. Exercise and evaluate - at least one tabletop exercise a year with IT, OT and management, and after every incident an evaluation that updates the plan

Also publish a point of contact, for example a security.txt file on your website, so that researchers and other CSIRTs can reach you. That reflects the RFC 2350 idea that a constituency must know where to turn. When you name your team, prefer the unbranded term CSIRT over CERT.

❓ Frequently asked questions

Can any organisation call its team a CERT?

CERT is a registered mark of Carnegie Mellon University, so the name is not free to use in the way the generic term CSIRT is. Carnegie Mellon used to grant licences worldwide, but it no longer does so outside the United States, where teams have to clear the name with their own trademark counsel. A new team therefore usually chooses the name CSIRT.

Which CSIRT is responsible for my organisation in the Netherlands?

Under the Dutch Cybersecurity Act, the NCSC is the statutory CSIRT for most sectors and CERT-WM for the water boards. For healthcare, Z-CERT is intended as the CSIRT, but the NCSC acts until it is designated. Reports from all sectors go through MijnNCSC, which forwards them to the right CSIRT and supervisory authority.

Does every organisation need its own CSIRT?

No, the law requires member states to designate CSIRTs, not individual companies. Essential and important entities under NIS2 must, however, be able to handle and report incidents, which requires a CSIRT function. That function can be in-house or bought in from an external provider.

What is a PSIRT?

A PSIRT (Product Security Incident Response Team) is a manufacturer’s CSIRT that receives, assesses and fixes vulnerabilities in its own products. Under the Cyber Resilience Act, manufacturers must handle vulnerabilities in a structured way, which in practice makes a PSIRT function indispensable. For OT users, the vendor’s PSIRT is the source of security advisories and patches.

How quickly must a CSIRT respond?

CSIRT response times depend on the agreements with the constituency, which are usually set per priority in a service level agreement. Under NIS2 and the Dutch Cybersecurity Act, the statutory CSIRT responds to an early warning without undue delay and, where possible, within 24 hours. An internal CSIRT must be faster, because the organisation itself has to report within 24 hours.

Why does a CSIRT need OT expertise?

A CSIRT without OT expertise can disrupt a production process or create an unsafe situation with standard IT measures. OT systems run on old operating systems, use industrial protocols and need to be restored in consultation with engineering. That is why organisations in critical sectors combine the CSIRT with process engineers or an OT SOC.

📌 In summary

A CSIRT receives, analyses and coordinates security incidents for a defined constituency, from a single company to an entire country. CSIRT and CERT do the same work: CERT is the name of the first team from 1988 and a mark of Carnegie Mellon University, while CSIRT is the generic and legal term. Under NIS2 and the Dutch Cybersecurity Act, the NCSC is the CSIRT for most sectors, where you report significant incidents within 24 hours. In OT, the work requires extra expertise, because the safety and availability of the process come first.

A CSIRT, or CERT, is the team that keeps oversight during a cyber incident, limits the damage and shares the knowledge; in IT/OT environments it only works well when it understands the physical process.