search menu icon-carat-right cmu-wordmark

Best Practices for National Cyber Security: Building a National Computer Security Incident Management Capability, Version 2.0

April 2011 Technical Report
John Haller, Samuel A. Merrell, Matthew J. Butkovic, Bradford J. Willke

In this 2011 report, an update to its 2010 counterpart, the authors provide insight that interested organizations and governments can use to develop a national incident management capability.

Publisher:

Software Engineering Institute

CMU/SEI Report Number

CMU/SEI-2011-TR-015

Abstract

As nations recognize that their critical infrastructures have integrated sophisticated information and communications technologies (ICT) to provide greater efficiency and reliability, they quickly realize the need to effectively manage risk arising from the use of these technologies. Establishing a national computer security incident management capability can be an important step in managing that risk.

In this document, an update to its 2010 counterpart, this capability is referred to as a National CSIRT, although the specific organizational form may vary among nations. Nations face various challenges when working to strengthen incident management, such as the lack of information providing guidance for establishing a national capability, determining how this capability can support national cyber security, and managing the national incident management capability. This document, first in the Best Practices for National Cyber Security series, provides information that interested organizations and governments can use to develop a national incident management capability. The document explains the need for national incident management and provides strategic goals, enabling goals, and additional resources pertaining to the establishment of National CSIRTs and organizations like them.