In addition to conducting extensive research, the CSIRT development team offers a variety of products and services to its constituency.

Products

• a suite of public incident management and CSIRT training courses
• publications and resources for creating and operating incident management and CSIRT capabilities
• Incident Management Capability Metrics Version 0.1 (pdf)
• Incident Management Mission Diagnostic Method, Version 1.0 (pdf)

Services

• assisting organizations in planning, implementing, and improving their incident management capabilities
• developing and delivering public courses, on-site courses, and facilitated workshops
• evaluating incident management capabilities
• certifying incident handlers
• licensing of training materials and a train-the-trainer program

Research

• incident management and CSIRT best practices
• CSIRT evaluation metrics, measurements, and tools
• incident management body of knowledge
• response strategies and best practices for various incident types

Need to create a CSIRT?
Creating a Computer Security Incident Response Team
March 14, 2011 (ARL)
October 10, 2011 (PGH)
December 6, 2011 (ARL)

For CSIRT Managers
Managing Computer Security Incident Response Teams
March 15-17, 2011 (ARL)
October 11-13, 2011 (PGH)
December 7-9, 2011 (ARL)

For New Incident Handlers
Fundamentals of Incident Handling
April 11-15, 2011 (ARL)
June 6-10, 2011 (APL)
August 15-19, 2011 (PGH)
September 26-30, 2011 (LON)
November 7-11, 2011 (ARL)

For Experienced Incident Handlers
Advanced Incident Handling for Technical Staff
May 2-6, 2011 (ARL)
July 18-22, 2011 (ARL)
September 19-23, 2011 (PGH)
October 31-November 4, 2011 (LON)
December 12-16, 2011 (ARL)

More courses

• Incident Response Trends for 2011 interview with G. Killcrece
• Incident Response Career Trends interview with G. Killcrece
• Establishing a National Computer Security Incident Response Team (CSIRT) podcast

Technical Reports

• Best Practices for National Cyber Security: Building a National Computer Security Incident Management Capability, Version 2.0 (pdf)
• Defining Incident Management Processes for CSIRTs: A Work in Progress (pdf)
• Handbook for Computer Security Incident Response Teams (CSIRTs) (pdf)
• State of the Practice of Computer Security Incident Response Teams (pdf)
• Incident Management Capability Metrics (pdf)
• Incident Management Mission Diagnostic Method (pdf)

Podcasts

• Incident Response Trends for 2011
• Incident Response Career Trends
• CERT Lessons Learned: A Conversation with Rich Pethia
• The Real Secrets of Incident Management
• Crisis Communications During a Security Incident
• Tackling Security at the National Level: A Resource for Leaders

More podcasts

Other Documents

• CSIRT Services
• Action List for Developing a Computer Security Incident Response Team (CSIRT)
• Staffing Your Computer Security Incident Response Team – What Basic Skills Are Needed?
• CSIRT Frequently Asked Questions

More documents

This map identifies locations of teams who have an established relationship with the CERT/CC and/or are members of FIRST.

CSIRT Lists

• FIRST Member team information
• TI Directory of European CSIRTs
• APCERT Member Teams