Which statement best describes CSIRT composition?

Which statement best describes CSIRT composition?

• A. It consists only of IT staff.
• B. It includes executives only.
• C. It is made up of a manager, cyber security personnel, a representative from legal counsel, and possibly someone from PR or HR, depending on type and severity.
• D. It is a group of external consultants.

Answer: (C)

A CSIRT is a cross-functional team that handles security incidents and communication, bringing together both technical responders and governance and communications stakeholders. The best composition includes a manager or incident commander to provide leadership and decision-making, cybersecurity personnel to perform the technical analysis and remediation, a representative from legal counsel to address regulatory, contractual, and policy implications, and, depending on the incident’s type and severity, someone from PR or HR to manage external communications and internal handling. This mix ensures not only effective containment and recovery but also proper legal compliance and appropriate messaging. Choosing only IT staff misses the governance and communications aspects; executives alone wouldn’t provide the technical depth needed for analysis and containment; relying solely on external consultants can hinder continuity and internal accountability.

A CSIRT is a cross-functional team that handles security incidents and communication, bringing together both technical responders and governance and communications stakeholders. The best composition includes a manager or incident commander to provide leadership and decision-making, cybersecurity personnel to perform the technical analysis and remediation, a representative from legal counsel to address regulatory, contractual, and policy implications, and, depending on the incident’s type and severity, someone from PR or HR to manage external communications and internal handling. This mix ensures not only effective containment and recovery but also proper legal compliance and appropriate messaging.

Choosing only IT staff misses the governance and communications aspects; executives alone wouldn’t provide the technical depth needed for analysis and containment; relying solely on external consultants can hinder continuity and internal accountability.