Typical Services a CSIRT Offers

A CSIRT isn't limited to "putting out fires": the FIRST standard groups its services into three categories. Reactive services are incident response proper, analysis of malicious artifacts and alert management. Proactive services seek to reduce the likelihood of an incident before it happens, and include vulnerability management, security assessments, dissemination of best practices and threat monitoring. Security quality management services add indirect value by strengthening the organization's overall posture, such as risk analysis, business continuity and awareness training. Explicitly defining which services the team offers, and which it doesn't, avoids expectations misaligned with business areas and makes it easier to size the team correctly.