Action List for Developing a Computer Security Incident Response Team (CSIRT)
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
This document provides a high-level overview of actions to take and topics to address when planning and implementing a Computer Security Incident Response Team (CSIRT). It also identifies some common problems teams may encounter in their implementation. The list draws on material presented in depth through CERT training courses and publications, and incorporates lessons learned by staff during their experiences planning and implementing CSIRTs. Use this list as a starting point to plan a CSIRT. More detailed information can be found in the list of resources at the end of this article.
Part of a Collection
Resources for Creating a CSIRT
Cite This SEI Report
Software Engineering Institute (2006, November 2). Action List for Developing a Computer Security Incident Response Team (CSIRT). Retrieved August 23, 2026, from https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/.
@techreport{Citekey_2006,
author={Software Engineering Institute},
title={Action List for Developing a Computer Security Incident Response Team (CSIRT)},
month={Nov},
year={2006},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/},
note={Accessed: 2026-Aug-23}
}
Software Engineering Institute. "Action List for Developing a Computer Security Incident Response Team (CSIRT)." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, November 2, 2006. https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/.
Software Engineering Institute, "Action List for Developing a Computer Security Incident Response Team (CSIRT)," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 2-Nov-2006 [Online]. Available: https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/. [Accessed: 23-Aug-2026].
Software Engineering Institute. "Action List for Developing a Computer Security Incident Response Team (CSIRT)." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 2 Nov. 2006. https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/. Accessed 23 Aug. 2026.
Software Engineering Institute. Action List for Developing a Computer Security Incident Response Team (CSIRT). Software Engineering Institute. 2006. https://www.sei.cmu.edu/library/action-list-for-developing-a-computer-security-incident-response-team-csirt/