In addition to conducting extensive research, the CSIRT development and training team offers a variety of products and services to its constituency.

Products

• a suite of public incident management and CSIRT training courses
• publications and resources for creating and operating incident management and CSIRT capabilities
• Incident Management Capability Metrics Version 0.1 (pdf)
• Incident Management Mission Diagnostic Method, Version 1.0 (pdf)

Services

• assisting organizations in planning, implementing, and improving their incident management capabilities
• developing and delivering public courses, on-site courses, and facilitated workshops
• evaluating incident management capabilities
• certifying incident handlers
• licensing of training materials and a train-the-trainer program

Research

• incident management and CSIRT best practices
• CSIRT evaluation metrics, measurements, and tools
• incident management body of knowledge
• response strategies and best practices for various incident types

Need to create a CSIRT?
Creating a Computer Security Incident Response Team
April 15, 2013 (ARL)
October 22, 2013 (ARL)

For CSIRT Managers
Managing Computer Security Incident Response Teams
April 16-18, 2013 (ARL)
October 23-25, 2013 (ARL)

For New Incident Handlers
Fundamentals of Incident Handling
February 4-8, 2013 (ARL)
May 13-17, 2013 (ARL)
August 5-9, 2013 (ARL)
October 14-18, 2013 (ARL)

For Experienced Incident Handlers
Advanced Incident Handling for Technical Staff
March 18-22, 2013 (ARL)
June 24-28, 2013 (ARL)
September 23-27, 2013 (ARL)
December 9-13, 2013 (ARL)

More courses

• How Ontologies Can Help Build a Science of Cybersecurity
• The MAL: A Malware Analysis Lexicon
• Communication Among Incident Responders—A Study
• Competency Lifecycle Roadmap: Toward Performance Readiness
• Building an Incident Management Body of Knowledge (pdf)
  presented at the First International Workshop on Security Ontologies and Taxonomies

• Communication Study
• Security and Ontology

Technical Reports

• The MAL: A Malware Analysis Lexicon
• Communication Among Incident Responders—A Study
• Competency Lifecycle Roadmap: Toward Performance Readiness
• Best Practices for National Cyber Security: Building a National Computer Security Incident Management Capability, Version 2.0 (pdf)
• Defining Incident Management Processes for CSIRTs: A Work in Progress (pdf)
• Handbook for Computer Security Incident Response Teams (CSIRTs) (pdf)
• State of the Practice of Computer Security Incident Response Teams (pdf)
• Incident Management Capability Metrics (pdf)
• Incident Management Mission Diagnostic Method (pdf)
• Building an Incident Management Body of Knowledge (pdf)
  presented at the First International Workshop on Security Ontologies and Taxonomies

Podcasts

• Establishing a National Computer Security Incident Response Team (CSIRT)
• Incident Response Trends (2011)
• Incident Response Career Trends
• CERT Lessons Learned: A Conversation with Rich Pethia
• The Real Secrets of Incident Management
• Crisis Communications During a Security Incident
• Tackling Security at the National Level: A Resource for Leaders

More podcasts

Other Documents

• CSIRT Services
• Action List for Developing a Computer Security Incident Response Team (CSIRT)
• Staffing Your Computer Security Incident Response Team – What Basic Skills Are Needed?
• CSIRT Frequently Asked Questions

More documents

Use this interactive map to locate CSIRTs with national responsibility around the world.

CSIRT Lists

• FIRST Member team information
• TI Directory of European CSIRTs
• APCERT Member Teams