What Is a CSIRT, and Why Should a Government Care?

Every country has a fire brigade. Almost nobody asks why. The need is obvious: fires happen, they spread, and a citizen with a bucket cannot fight one alone.

A CSIRT is the fire brigade for digital incidents. The acronym stands for Computer Security Incident Response Team; you will also see CERT (Computer Emergency Response Team) — for policy purposes, treat them as the same thing. In my glossary I gave the two-sentence version. This piece is the full explainer, following the method I laid out in Teaching Cybersecurity to People Who Will Never Write Code: one concept per block, honest analogies, and a clear statement of the decision you own.

The decision, if you work in government, is simple to state: does your country have a functioning national CSIRT, and if it exists on paper, does it actually answer the phone?

What a CSIRT does all day

I spent part of my career inside a security operations centre at a major Nordic telecom, doing live incident monitoring, triage, and response, and writing the playbooks that guide it. A national CSIRT does recognisably similar work, at country scale. A normal day contains four kinds of work:

THE INCIDENT LOOP  —  what a CSIRT runs, day and night

   DETECT --> TRIAGE --> CONTAIN --> ERADICATE --> RECOVER
     ^                                                |
     +---------------------  LEARN  <-----------------+
                 feed the lessons back into detection

Two things surprise people about this list. First, most of the day is triage, not heroics. In my SOC years, the core skill was not stopping dramatic attacks; it was deciding, quickly and correctly, which alarms deserved attention. Second, the coordination row is the most valuable one at national level. A CSIRT is the one body whose job is to notice that the strange thing happening at one bank is also happening at three others.

Where the fire-brigade analogy breaks

I promised honest analogies, so here are the breaking points — and as usual, they carry the real lesson.

Fires do not hide. A building fire announces itself. A digital intruder's first priority is to stay invisible, sometimes for months. So a CSIRT is not only a response crew; it is also a detective agency looking for fires that are already burning quietly.

Fires do not adapt. Fire obeys chemistry. A threat actor — a human adversary — watches how you respond and changes tactics. Playbooks help, but they are updated constantly because the other side reads the news too.

Arson from abroad is rare; digital arson from abroad is the norm. Your fire brigade never needs to negotiate with a brigade on another continent about the same fire. A national CSIRT does this weekly. Incidents cross borders by default, which is why CSIRTs form international networks and why having no CSIRT means having no seat in those networks.

The brigade can also inspect. This part of the analogy actually holds, and it matters: good fire services do prevention — inspections, codes, drills. Mature CSIRTs do the same with security assessments, advisories, and exercises. A CSIRT that only fights fires is half a CSIRT.

Why a country without one is structurally blind

Here is the argument I most want a policymaker to take away.

Without a national CSIRT, a country does not merely respond to incidents badly. It does not know what is happening to it at all. There is no organisation whose job is to collect reports, connect patterns, warn the next victim, or represent the country when an incident crosses a border. Individual banks and telecoms may each defend themselves competently, but nobody holds the national picture.

Blindness has three concrete costs:

• No early warning. The first victim's pain cannot protect the tenth victim, because no one is positioned to pass the warning along.
• No national memory. Each incident is experienced as unprecedented, because no institution accumulates the lessons.
• No credible interlocutor. When a foreign team detects an attack coming from your country's networks, they need someone to call. If no one answers, your country becomes a safe harbour by accident — and gets treated accordingly.

I grew up professionally around the question of what happens when digital infrastructure and state capacity collide; my engineering thesis involved fieldwork with real users navigating network restrictions in Iran, and I have lived through national-scale shutdowns while running my own practice. One lesson from both: institutions matter more than tools. A country can buy every security product on the market and still be blind, because sight is an institutional capability, not a purchase.

The questions a policymaker should ask

If you hold or influence a budget, here is the checklist. You do not need technical knowledge to ask any of these:

• ☐ Does a national CSIRT exist in law, with a defined mandate — not just a plan to create one?
• ☐ Does it have a public contact point that is genuinely staffed?
• ☐ Is it authorised to receive incident reports from the private sector, and do companies actually report?
• ☐ Is it connected to the international CSIRT community, or does it work in isolation?
• ☐ Does it publish advisories and warnings, or only respond privately?
• ☐ Does it run exercises — practice fires — with critical infrastructure operators?

A "no" on any line is a finding. A "no" on three or more means your country has a fire brigade sign on an empty building.

What comes next

Saying "every country needs a CSIRT" is easy. Building one — with real staffing, real trust from industry, and real authority — is a governance project, not an IT project, and it fails in predictable ways. The next piece in this series is a close look at exactly that: how one West African country approached CSIRT capacity building, what worked, and what the effort reveals about the governance layer most national cyber strategies skip.

For now, keep the one-sentence version: a CSIRT is how a country sees. Everything else in national cyber policy assumes that sight exists.

CSIRT Capacity Building: The Missing Governance Layer →

← All writeups