CSIRT / CERT (incident response team)
CERT · CSIRT · Computer Security Incident Response Team · Computer Emergency Response Team · CERT-FR · regional CSIRT · incident response team
A team dedicated to responding to security incidents for a given constituency (a company, a sector, a region, a country), which warns, advises and coordinates the response.
In practice
CERT-FR, part of ANSSI, is France’s government CSIRT: it acts first for central government, operators of vital importance and operators of essential services, and publishes alerts, security advisories and indicators of compromise. SMEs, local authorities and associations can turn to Cybermalveillance.gouv.fr, the French national assistance platform, and to regional CSIRTs set up with ANSSI’s support. At EU level, the CSIRTs Network links national teams. Large organisations often have their own CSIRT, working hand in hand with the SOC.
Fictional case: a French manufacturing SME discovers ransomware on a Saturday morning. It describes the situation on Cybermalveillance.gouv.fr, which refers it to its regional CSIRT; the CSIRT helps assess the incident and points it to incident response providers.
