CSIRT
CSIRT stands for computer security incident response team. Every Member State has at least one. Under the Cyber Resilience Act, the CSIRT is the body that receives manufacturers' notifications, reviews them and passes them on to other Member States concerned.
A CSIRT (computer security incident response team) is the national team for cybersecurity incidents that every Member State designates under the NIS2 Directive. Under the Cyber Resilience Act, it receives manufacturers' notifications.
Definition in the Regulation
Regulation (EU) 2024/2847 does not define the term CSIRT as such; for the CSIRT designated as coordinator, Article 3, point (51) refers to Article 12(1) of Directive (EU) 2022/2555 (NIS2). Several provisions give the CSIRT tasks. Under Article 14(1) and (3), the CSIRT designated as coordinator receives every notification at the same time as ENISA. Under Article 14(6), it can request an intermediate report. Under Article 14(8), it may inform users itself if the manufacturer fails to do so in a timely manner. Under Article 16(2), it forwards notifications to the CSIRTs of the Member States in which the product has been made available, and may delay dissemination on cybersecurity grounds. Under Article 16(3), it passes information to the market surveillance authorities. Under Article 15(4), it informs the manufacturer when a third party has reported an actively exploited vulnerability.
What it means for manufacturers
In Germany, the CSIRT is CERT-Bund within the BSI; in Austria, it is CERT.at. The CSIRT reviews the notification on the platform and sets its status to "Valid", "Invalid" or "Closed"; it also verifies that the reporting person belongs to the manufacturer. A message from the CSIRT that a vulnerability is being exploited is a suspicious event that the manufacturer must assess straight away. Under recital 76, the CSIRT is also the channel through which security researchers can report vulnerabilities anonymously if the direct route to the manufacturer does not work.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit