CSIRT. DivergeIT shall provide your Computer Security Incident Response Team processes and will perform initial security incident triage for all threats identified via detection and or report by Customer. DivergeIT will provide a CSIRT report for any confirmed security breach investigated. There are Incident Response Resources available to remediate large scale impact upon request at an additional charge.
CSIRT. A typical definition of a CSIRT holds that “A Computer Security Incident Response Team (CSIRT) is an organizational unit (which may be virtual) or a capability that provides services and support to a defined constituency for preventing, detecting, handling, and responding to computer security incidents, in accordance with its mission. A properly deployed CSIRT has a clear mandate, a governance model, a tailored services framework, technologies and processes to provide, measure and continuously improve defined services. “(FIRST CSIRT Framework v2.0 2019 [FIRST_CSIRT]) A similar definition is provided by XXXXX, who holds that “A CSIRT is a team of IT security experts whose main business is to respond to computer security incidents. It provides the services to handle 5 xxxxx://xxx.xxxx.xxxxxx.xx/newsroom-and-events/press-releases/easa-cooperate-cert-eu-cybersecurity 6 xxxxx://xxx.xxxxxxx.xxx/events/cyber-security-for-railways-conference-2017 them and support their constituents to recover from breaches” (XXXXX XXXXX Setting-up Guide 2006 [ENISA_CSIRT, 2006]). While the ENISA definition emphasises “response”, the FIRST definition includes both “prevention” and “response”, but both do follow very similar structures and functionality. CSIRTs generally are often defined as internal to a specific organisation, yet the EU Member State CSIRTs are at national level, and each represents many government departments, and coordinates across a country to support multiple stakeholders under ECN coordination. A Rail CSIRT would have to operate across the Rail transport sector (EU Rail – SERA), and would need a coordinated response approach, as well as possible prevention support. This latter aspect may be delivered by the XX-XXXX or by the CSIRT itself.
