CSIRT
Definition
Computer Security Incident Response Team. The organisational unit responsible for preparing for, detecting, coordinating, and resolving security incidents. Sometimes called CERT (Computer Emergency Response Team) or CIRT (Computer Incident Response Team) depending on the organisation.
- Full name
- Computer Security Incident Response Team
- Core responsibilities
- Prepare for, detect, coordinate, resolve incidents
- Alternate names
- CERT or CIRT depending on the organisation
- Role in investigations
- Organisational unit coordinating incident handling
Common questions
Why do different organisations use CERT, CIRT, or CSIRT for what sounds like the same function?+
The terms reflect naming choices made by different organisations and countries rather than a functional distinction; CERT was the earliest term and remains trademark-sensitive for some uses, which led many later teams to adopt CSIRT or CIRT instead while performing essentially the same role.
How does a CSIRT typically interact with a forensic investigator during a live incident?+
The CSIRT usually leads containment and coordination while forensic investigators, whether internal or external, handle the evidence preservation and analysis, with the two functions working from a shared incident timeline so containment actions do not destroy evidence needed later.
Related terms
- FIRST
- Forum of Incident Response and Security Teams. A global membership organisation that sets standards for CSIRT capability and facilitates trusted information sharing...
- Legal Liaison
- The CSIRT role responsible for advising on legal obligations during an incident: evidence preservation requirements, breach notification deadlines, law enforcement engagement, and...
- National CERT
- A government-operated or government-designated team responsible for coordinating cyber incident information at the national level. Examples include CERT-In (India), CISA (US), NCSC...
- Retainer Agreement
- A contract between an organisation and an external IR firm that guarantees a defined response time and service scope in exchange for...
- Team Lead
- The person who owns the incident response process during an active incident. The team lead coordinates analyst tasks, manages escalation to leadership,...