Question

Is a CSIRT required by any laws, regulations, or contractual obligations? How have those regulations influenced the CSIRT in your organization or industry? For example, is having a CSIRT capability just a “check box” on the road to compliance or has it been fully implemented, or perhaps something in between?

Answer 1

A computer security incident response team (CSIRT) is an organization that receives reports of security breaches, performs report analyzes, and responds to senders. A CSIRT can be an established group or an ad hoc assembly.

The CSIRT’s main objective is to minimize the impact of any incidents. The team must include professionals who have expertise in varied fields from security analysts and incident handlers to network and system administrators, vulnerability handlers, trainers and management-level employees. The team should also try to involve other departments of the company, from human resources and legal to public relations and customer support. This is because resolving an incident doesn’t just mean stopping an intrusion, isolating the affected systems, recovering data and applying countermeasures. It also means responding to managers, keeping communication open with customers and the public, as well as requesting disciplinary actions if applicable.

Although government doesn't mandate companies to have a CSIRT, but it is a essential component of an organisation / industry and not just a "check box" for an organisation. CSIRT can both be external or internal to the organisation.