PSIRT
Product security incident response team
The team in a vendor that receives vulnerability reports about its products, coordinates fixes, publishes advisories and often acts as the CVE Numbering Authority; FIRST’s PSIRT Services Framework describes its services.
- Defined in
- FIRST PSIRT Services Framework 1.1
Covered in
Guide
Set up a PSIRT: services, intake, triage, SLAs and the CNA role
How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.
Guide
Run coordinated vulnerability disclosure from report to advisory
Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.