Digital Forensics and Incident Response - Second Edition

The incident response charter

The first step to building this capability is the decision by senior leadership that the risk to the organization is too significant not to address the possibility of a potential security incident. Once that point is reached, a senior member of the organization will serve as a project sponsor and craft the incident response charter. This charter outlines key elements that will drive the creation of a Computer Security Incident Response Team (CSIRT).

While there are several titles for incident response teams, the term CERT is often associated with the US-CERT through the United States Department of Homeland Security or the Computer Emergency Response Team Coordination Center (CERT/CC), through the Carnegie Mellon ...