What Is a Computer Security Incident Response Team (CSIRT)?

A computer security incident response team (CSIRT) is the group an organization assigns to coordinate its response to security incidents. A SOC usually focuses on monitoring, detection, triage, and initial response. The CSIRT coordinates response for a defined constituency and connects technical responders with legal, communications, leadership, and outside parties. In many organizations the two overlap.

The CSIRT's decision rights have to be written down before an incident, or response stalls even when detection works and the alert fires. Attackers keep shortening the window. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time in 2025, the interval from initial access to lateral movement onto another system, at 29 minutes, with the fastest at 27 seconds. A plan that still has to work out who may take a server offline is likely to lose that race.

TL;DR:

• A CSIRT is defined by its mandate and the constituency it serves, and it can be a virtual team with no dedicated headcount.
• The SOC usually handles monitoring and first response, while the CSIRT coordinates significant incidents and pulls in legal, communications, and leadership.
• No major standard assigns a default holder of shutdown authority, so every team has to pre-authorize containment in writing, whatever its staffing model.
• MDR contracts vary in how much incident response they include, so a separate retainer may still be needed for forensics, counsel-directed investigations, or insurer panel requirements.

What a Computer Security Incident Response Team Is

Standards bodies define a CSIRT by what it is assigned to do. The SEI's 2007 definition describes one or more staff assigned to coordinate and support the response to security incidents. FIRST's CSIRT Services Framework, version 2.1 from 2019, adds that the team may be virtual, or simply a capability serving a defined constituency: the people, systems, or organizations it is responsible for. Neither definition requires a dedicated room or a fixed roster.

Where the Term Came From

The model dates to November 2, 1988, when the Morris worm crippled much of the early internet. DARPA then asked the SEI to set up a computer emergency response team, which became the CERT Coordination Center. As other organizations built their own teams, FIRST formed in 1990 to coordinate them.

CSIRT, CIRT, CERT, PSIRT, and SIRT

Most of these labels describe the same function under different branding, and NIST's glossary treats CIRT, CSIRT, and CIRC as one team. CERT is a registered trademark of Carnegie Mellon University. CMU has stopped licensing the mark internationally, though U.S. teams may still apply for authorization to use it. SIRT (security incident response team) appears mostly in team names such as Amazon SIRT and Netflix SIRT, with no separate formal definition.

PSIRT is the label with a real distinction. FIRST's framework treats the product focus as what sets a PSIRT apart: it handles vulnerabilities in the products a vendor ships, while an enterprise CSIRT protects the organization's own systems and networks. The two depend on each other, because CSIRT vulnerability warnings almost always rest on PSIRT information.

How a CSIRT Differs From a SOC

The SEI separated the CSIRT from the IT security team that handles day-to-day monitoring and patching as early as a 2004 FIRST training deck, which also lists legal and public relations staff among the people a CSIRT brings in. FIRST's current framework lets a CSIRT run monitoring services too, so organizations draw the line in different places.

How cleanly the two split depends on organization size. As of ENISA's 2020 guidance, smaller organizations often treat CSIRTs and SOCs as synonymous, while large enterprises sometimes keep the SOC on monitoring and detection and hand incident handling to a separate CSIRT.

A SOC may also take on first-level incident management, or even second-level, such as initiating mitigations, so the handoff between the SOC and the CSIRT has to work. How the SOC team is structured therefore decides where the CSIRT's work begins.

The table below sets the two functions side by side.

‍

Core Roles and Who Holds Decision Authority

Standards bodies largely agree on the roles and leave decision authority to each organization. NIST's current incident response guidance, SP 800-61 Rev. 3, replaced the 2012 Rev. 2 in April 2025. Response once sat almost entirely with an organization's own incident handlers and now depends on many internal and external parties. The recurring roles are:

• Incident manager or commander, who coordinates all handling activity and represents the team externally.
• Incident handlers, who, in NIST's description, verify that an incident occurred, collect and analyze evidence, prioritize activities, limit damage, and find root causes.
• Forensic analysts, who preserve and analyze evidence, including chain of custody, in case it ends up in legal proceedings.
• A communications lead and a single spokesperson with predefined approval paths, as CISA's joint guidance for service providers recommends.
• Legal, which Rev. 3 lists among the core internal roles, often working with outside counsel.
• Executive leadership, which NIST notes may hold decision-making authority on high-impact actions, such as shutting down or rebuilding critical services.

NIST's example places shutdown authority with leadership, but none of the standards above assigns a single default holder. CISA's advisory on two SOC red team assessments goes furthest, recommending that defenders be able to isolate systems or block traffic without a long chain of approvals.

Our position: pre-authorize endpoint isolation, credential revocation, and traffic blocking in writing, and reserve executive sign-off for production shutdowns. In intrusions where an initial-access actor passed access to a second threat group, Mandiant's M-Trends 2026 found the median hand-off took 22 seconds in 2025, down from more than eight hours in 2022.

Staffing Models: In-House, Hybrid, and Outsourced

Every staffing model trades cost against control, and none of them moves accountability off the organization. NIST's 2012 Rev. 2, now withdrawn, set out the taxonomy many teams still use. Team structures were central, distributed, and coordinating, and NIST described the last as "a CSIRT for CSIRTs" that advises other teams without authority over them. Staffing models were employees, partially outsourced, and fully outsourced. Rev. 3 does not restate that taxonomy in full, so it now serves as working vocabulary only.

In-House

In a 2023 SANS survey, 59% of respondents kept incident response fully in-house, compared with 46% for SOC functions. In-house teams keep business context and decision authority close. The catch is staffing. Cost is a major factor, especially when staff must be onsite 24/7, and many organizations struggle to find skilled people willing to cover round-the-clock support.

A 2017 ThaiCERT handbook hosted by FIRST gives a community rule of thumb of four full-time staff just to deliver incident response and announcements, and 12 for round-the-clock operation. Organizations with limited funding or incident volume can run part-time members as a virtual team instead.

Partially Outsourced (Hybrid)

Rev. 2 described the most prevalent partially outsourced arrangement as outsourcing 24/7 monitoring to a managed provider that reports suspected incidents to the internal team. Another common pattern keeps response in-house and calls in contractors for serious or widespread incidents. In our view, unclear handoffs do the most damage in hybrid models.

Fully Outsourced

Even here, NIST assumes a single employee with designated alternates oversees the outsourcer. Organizations are often reluctant to give outsourcers authority over operational decisions such as disconnecting a web server, so those decision points need to be documented.

How a CSIRT Works With an MDR Provider

NIST Rev. 3 counts contracted incident handlers, such as an outsourced SOC, as part of the response capability, so the MDR provider belongs in the CSIRT plan.

Providers vary widely in what they can do without asking. Sophos's service description lets customers choose Authorize, Collaborate, or Notify Only modes, with an option for Collaborate to switch to Authorize when no customer contact acknowledges Sophos's attempts to reach them. At Expel, isolating non-critical endpoints is typically auto-approved; taking production servers offline or disabling executive accounts requires customer approval, with the list set during onboarding.

Whichever provider you use, the CSIRT should own the written list of pre-approved actions and the contact sequence for 3am. Rapid7's MDR Elite scope, for example, commits to calling designated contacts within 30 minutes of identifying a medium- or high-severity incident, in the order the customer defines.

The MDR scope boundary is also where legal and insurance constraints apply. Privilege over a breach investigation depends on the facts and the jurisdiction. Forensic work directed by outside counsel to support legal advice or anticipated litigation may qualify, but courts also weigh why the work was done, how it relates to ordinary business, and who received the report. Courts have also ruled that counsel's involvement alone was not enough.

Insurers add their own constraints, since many cyber policies steer incident response toward panel vendors and set conditions for using anyone else.

MDR scope varies as well. Rapid7's MDR Elite includes remote incident response led by an incident manager. Sophos's Notify Only mode stops at remediation guidance. Where the MDR scope, legal requirements, or insurer conditions leave gaps, organizations add a separate IR retainer. Retainers range from prepaid hour blocks to zero-dollar arrangements that lock rate, scope, and SLA and bill only at activation.

Reporting deadlines stay with the organization no matter who contains the threat, so the response plan should say how the CSIRT, legal, compliance, and leadership make reporting decisions.

NIS2, the EU's 2022 directive, generally requires covered entities to send an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month of that notification. National implementing laws set some of the details.

For financial entities, DORA's delegated regulation requires an initial report within four hours of classifying an incident as major, and generally no later than 24 hours after becoming aware of it. For SEC registrants, Form 8-K Item 1.05 filings are due within four business days of determining an incident is material. The MDR provider can feed those determinations, but the filing decisions remain the organization's.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its MDR service investigates alerts and takes response actions within a scope agreed with the customer in advance.

How to Choose a CSIRT Staffing Model

Map your situation to these conditions:

• With one to three security staff and no overnight coverage, outsource monitoring and first-line response to an MDR provider and name an internal incident manager with alternates. Check whether the MDR scope covers major-incident response before adding an IR retainer with a firm your insurer accepts.
• If you already run a SOC with on-call responders, formalize the CSIRT as a virtual team with a written mandate, and bring in outside help for forensics and surge capacity.
• Where your insurance policy or other requirements constrain who investigates, select the retainer firm against those constraints before you sign, and have outside counsel direct the breach investigation from the start.
• If your environment spans regions or business units, use a distributed model organized as a single coordinated entity such as a federation, in Rev. 3's wording.
• If your MDR contract lists response actions without pre-authorization terms, renegotiate before the next renewal, because unclear authority will slow containment whatever the provider's capability.

Whichever model you choose, run a tabletop exercise that forces those decisions early, before a real incident tests them.

Frequently Asked Questions About Computer Security Incident Response Teams

What Does a CSIRT Do Between Incidents?

A CSIRT's responsibilities can extend well beyond active incidents. FIRST's services framework groups CSIRT services into five areas: information security event management, incident management, vulnerability management, situational awareness, and knowledge transfer. Between incidents, that means tracking vulnerabilities in the constituency's systems, gathering and sharing threat information, running training and exercises, and advising on policy. Few teams offer every service in the framework.

Who Should Declare an Incident, the SOC or the CSIRT?

Organizations split this differently, with some letting SOC analysts declare and others reserving declaration for the IR lead. Our recommendation: let the on-call incident manager declare a provisional incident and start protective actions immediately, with the CISO or a designated alternate confirming or revising the classification afterward.

What Happens When an Outside IR Firm Takes Over Mid-Incident?

The MDR provider hands over what it has and returns to monitoring. Rapid7's scope document, for example, describes a handover meeting with the third-party firm and the customer, delivery of investigation findings, status updates, and forensic artifacts, and platform access for the new team, after which Rapid7's direct involvement in the investigation ends. The CSIRT plan should name who grants that access and who keeps the incident timeline continuous across the switch.

Does NIST SP 800-61 Rev. 3 Change How the Team Should Be Structured?

It changes the framing more than the org chart. Rev. 3 maps incident response onto the six Functions of NIST's Cybersecurity Framework (CSF) 2.0, treating Govern, Identify, and Protect as preparation and Detect, Respond, and Recover as response. Rev. 3 also presents a new lifecycle model built on those Functions, maps the earlier step-by-step lifecycle phases onto them, and lets organizations use whichever model suits them, so teams with runbooks built on Rev. 2's phases can keep them.

Which CSIRT Metrics Are Worth Reporting?

Time to contain carries the most signal when you segment it by incident class and severity. Sygnia illustrates the gap with a team that closes 98% of tickets within SLA and still takes six days to contain a ransomware attack. Ticket counts and alerts processed say little about how fast a team contains an incident. For post-incident work, incident recurrence rate shows whether action items are fixing anything.