Key Considerations for Managing and Selecting CIRT Members

Managing the Team

Communications Officer

During a cyber incident, decision-making speed is crucial. The CIRT manager must foster a collaborative environment where team members can work quickly and cohesively. Post-incident, the team should conduct a post-mortem review to identify lessons learned and improve future responses.

Training and Readiness

It is not enough to assemble the team; continuous training is essential. Regular incident response drills, such as tabletop exercises, help ensure that team members are well-prepared and familiar with their roles. These exercises can also reveal gaps in the response plan that need to be addressed.

Clear Roles & Responsibilities

Network Security Engineer

Forensic Analyst

Incident Manager

Diverse Skill Sets

Key Considerations for Managing and Selecting CIRT MEMBERS

Legal & Compliance Knowledge

Communication Skills

Technical Expertise

It is equally important to have members who can communicate effectively with both technical teams and non-technical stakeholders. During a security incident, CIRT members need to provide clear updates to management, customers, and, if necessary, law enforcement.

Communication Skills

This role focuses on investigating the incident, collecting and analyzing evidence to understand how the breach occurred and what data was compromised.

Forensic Analyst

The communications officer handles external and internal communications, ensuring accurate, timely, and clear updates during and after an incident.

Communications Officer

Understanding the legal implications of data breaches and compliance requirements (e.g., GDPR, HIPAA) is crucial. This ensures that the organization adheres to regulations when handling incidents and reporting breaches.

Legal & Compliance Knowledge

This member monitors the network and is responsible for isolating affected systems, blocking malicious traffic, and implementing patches.

Network Security Engineer

The CIRT must have individuals with strong technical capabilities, including network security, digital forensics, and malware analysis. These experts will be responsible for identifying the scope of the attack, stopping the breach, and preventing future incidents.

Technical Expertise

The incident manager is the team leader who oversees the entire incident response process, coordinating between technical and business teams.

Incident Manager