Software Engineering Institute

As nations recognize that their critical infrastructures have integrated sophisticated information and communications technologies (ICT) to provide greater efficiency and reliability, they quickly acknowledge the need to effectively manage risk arising from the use of these technologies. Establishing a national computer security incident management capability can be an important step in managing that risk. In this document, this capability is referred to as a National Computer Security Incident Response Team (National CSIRT), although the specific organizational form may vary among nations. The challenge that nations face when working to strengthen incident management is the lack of information that provides guidance for establishing a capacity appropriate to the nation, understanding how it supports national cyber security, and managing the national incident management capability. This document—first in the Best Practices for National Cyber Security Series—provides insight that interested organizations and governments can use to begin to develop a national incident management capability. The document explains the need for national incident management and provides strategic goals, enabling goals, and additional resources pertaining to the establishment of National CSIRTs and organizations like them.