Organizational Models for Computer Security Incident Response Teams (CSIRTs)
• SEI Report
Publisher
Software Engineering Institute
CMU/SEI Report Number
CMU/SEI-2003-HB-001DOI (Digital Object Identifier)
10.1184/R1/6575921.v1Topic or Tag
Abstract
When a computer security attack on an organization occurs, an intrusion is recognized, or some other kind of computer security incident occurs, it is critical for the organization to have a fast and effective means of responding. One method of addressing this need is to establish a formal incident response capability or a Computer Security Incident Response Team (CSIRT). When an incident occurs, the goal of the CSIRT is to control and minimize any damage, preserve evidence, provide quick and efficient recovery, prevent similar future events, and gain insight into threats against the organization.
This handbook describes different organizational models for implementing incident handling capabilities, including each model's advantages and disadvantages and the kinds of incident management services that best fit with it. An earlier SEI publication, the Handbook for Computer Security Incident Response Teams (CSIRTs) (CMU/SEI-2003-HB-002), provided the baselines for establishing incident response capabilities. This new handbook builds on that coverage by enabling organizations to compare and evaluate CSIRT models. Based on this review they can then identify a model for implementation that addresses their needs and requirements.
Part of a Collection
Resources for Creating a CSIRT
Cite This SEI Report
Killcrece, G., Kossakowski, K., Ruefle, R., & Zajicek, M. (2003, December 1). Organizational Models for Computer Security Incident Response Teams (CSIRTs). (SEI Report CMU/SEI-2003-HB-001). Retrieved October 18, 2026, from https://doi.org/10.1184/R1/6575921.v1.
@techreport{killcrece_2003,
author={Killcrece, Georgia and Kossakowski, Klaus-Peter and Ruefle, Robin and Zajicek, Mark},
title={Organizational Models for Computer Security Incident Response Teams (CSIRTs)},
month={Dec},
year={2003},
number={{CMU/SEI-2003-HB-001},
institution={Software Engineering Institute, Carnegie Mellon University},
doi={10.1184/R1/6575921.v1},
url={https://doi.org/10.1184/R1/6575921.v1},
note={Accessed: 2026-Oct-18}
}
Killcrece, Georgia, Klaus-Peter Kossakowski, Robin Ruefle, and Mark Zajicek. "Organizational Models for Computer Security Incident Response Teams (CSIRTs)." (CMU/SEI-2003-HB-001). Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, December 1, 2003. https://doi.org/10.1184/R1/6575921.v1.
G. Killcrece, K. Kossakowski, R. Ruefle, and M. Zajicek, "Organizational Models for Computer Security Incident Response Teams (CSIRTs)," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, SEI Report CMU/SEI-2003-HB-001, 1-Dec-2003 [Online]. Available: https://doi.org/10.1184/R1/6575921.v1. [Accessed: 18-Oct-2026].
Killcrece, Georgia, Klaus-Peter Kossakowski, Robin Ruefle, and Mark Zajicek. "Organizational Models for Computer Security Incident Response Teams (CSIRTs)." (SEI Report CMU/SEI-2003-HB-001). Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 1 Dec. 2003. https://doi.org/10.1184/R1/6575921.v1. Accessed 18 Oct. 2026.
Killcrece, Georgia; Kossakowski, Klaus-Peter; Ruefle, Robin; & Zajicek, Mark. Organizational Models for Computer Security Incident Response Teams (CSIRTs). CMU/SEI-2003-HB-001. Software Engineering Institute. 2003. DOI: 10.1184/R1/6575921.v1. https://doi.org/10.1184/R1/6575921.v1