CSIRT Operations

CSIRT Operations is a working handbook for security managers, team leads, and senior analysts who have been asked to stand up, mature, or rationalize a Computer Security Incident Response Team. It assumes you already understand networks, endpoints, malware, and basic detection concepts, but have never had to write a charter, fight for headcount, design an on call rotation, defend a budget, run a war room, or sit across the table from a regulator.

Across twelve chapters, you'll learn how to define a constituency, choose an organizational model, build a service catalog grounded in the FIRST CSIRT Services Framework, structure and staff a team, write policy and playbooks aligned to NIST SP 800-61 Rev. 3 and ISO/IEC 27035, design the tooling stack, run the incident handling workflow, coordinate externally using TLP 2.0, manage major incidents, exercise the team, measure what matters, and roadmap growth toward threat hunting and intelligence.

Every chapter ships with practical, ready to adapt artifacts: charter outlines, service catalogs, skills matrices, on call schedules, severity matrices, executive briefing templates, a full tabletop scenario, and a worked example of standing up a CSIRT in a mid size company from charter to first major incident.

The literature on incident response is full of breach postmortems and tool reviews. This book is different. It's for the people who have to defend a budget, hire a forensic lead, write a charter the general counsel will actually sign, and run a tabletop that doesn't waste everyone's afternoon, and who would like to do those things well the first time.