CSIRT

What it means

A CSIRT is a computer security incident response team. It receives reports, analyses attacks, coordinates the response and warns others about new threats. The term is often used interchangeably with CERT, which describes similar teams under a historically different name.

Slovakia has the national SK-CERT at the National Security Authority and a government CSIRT for public administration, alongside sector and corporate teams. Under the Cybersecurity Act, serious incidents are reported to the national CSIRT.

Only a large organisation can afford its own CSIRT. Smaller firms rely on an external security provider that plays the same role, and in a serious attack they can also turn to the national team, which helps attack victims free of charge.

How it works in practice

In an incident such as a ransomware attack, contacting a CSIRT is one of the first steps of the incident response plan. The team advises on preserving evidence, whether this is a known campaign and where to look for possible decryption tools.

Entities covered by NIS2 must report a significant incident within short deadlines, with an early warning usually within 24 hours. It is wise to prepare contacts, a reporting template and a named person who can file the report at night or over a weekend.

CSIRTs publish warnings about actively exploited vulnerabilities identified by CVE numbers. Following these alerts helps an IT administrator decide which patches to install immediately and which can wait for the normal update cycle.

What to watch out for

Reporting to a CSIRT does not replace other duties. If the attack affected personal data, a separate 72-hour deadline applies for notifying the data protection authority, and where a crime was committed a report to the police is also advisable.

Under cyber insurance, the insurer often requires the incident to be handled by its appointed team. A firm that hires another provider or pays a ransom without agreement may lose cover, so the policy terms should be known before an attack.