emergencies and incidents --- @Eduardo. Interesting observation. I assume that CERTs would always be called upon when incidents occur or when such incidents are not attended to in a timely manner leading to an emergency situation. It may also be possible, depending on the type of CERT i.e. reactive or proactive that a heavy unusual data traffic may be observed which to the support engineer, turns out to be symptoms of a DOS or DDOS attack; the CERT can also be activated by other CERTs who may be seeing unusual internet traffic coming his way - there are many scenarios which can develop their capacity.

Source author: Bennette Thomas thomasb@dominica.gov.dm