Responding to incidents --- CERT and CSIRT is really the same thing in practice. When it comes to terminology, an incident is a common operational term; yet, an incident can be of various levels - from a minor incident with minor effects, to major incident with critical effects. Classification of incidents is one of the important tasks of each CERT - and international communities are trying to sync the understanding and classifications as well. Emergency, on the other hand, is more of a situation - though it is used in the name of the CERT.

In what cases CERTs/CSIRTs respond to incidents really? That depends on the capacity and policies of each of the CERTs. Most CERTs, even if they can receive reports of incidents from just anyone (including citizens), don't have capacities - or even mandates - to respond actively unless it is for critical infrastructure or so. Instead, they limit their work to collecting and sharing information, issuing warnings, awareness-raising, etc.

Only when a country has recognised cybersecurity as one of the national priorities, and puts sufficient political and financial efforts in addressing the risks, CERTs become more resources (in terms of people, funds, knowledge, equipment, ...) and able to really play a role of a 'firefighter' more broadly. This is often a later stage in the CERT development.

Source author: Vladimir Radunovic vladar@diplomacy.edu