CSIRT
Computer security incident response team
A team that receives, analyzes and coordinates the response to security incidents for an organization, a sector or a country. Under the EU Cyber Resilience Act, manufacturers notify the national CSIRT designated as coordinator, and ENISA, of actively exploited vulnerabilities.
- Defined in
- FIRST CSIRT Services Framework 2.1
Covered in
Build a runbook for CRA vulnerability and incident reporting
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 and 72 hours. Decide what is reportable, start the clock at the right moment, file through the platform and keep an evidence trail.
Set up a PSIRT: services, intake, triage, SLAs and the CNA role
How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.