PSIRT
PSIRT stands for Product Security Incident Response Team: the function in a company where vulnerability reports about its own products arrive and are handled. The Cyber Resilience Act does not use the term, but it requires exactly these tasks.
A PSIRT (Product Security Incident Response Team) is the manufacturer's team that receives, assesses, fixes and publishes vulnerability reports about its own products. It is the counterpart to the CSIRT, which looks after the company's own IT infrastructure.
Definition in the Regulation
The Regulation does not define the term, and Regulation (EU) 2024/2847 does not require a team with this name. What it does require are the tasks: under Annex I, Part II, manufacturers must address and remediate vulnerabilities without delay (point (2)), put in place a policy on coordinated vulnerability disclosure (point (5)) and provide a contact address for reporting vulnerabilities (point (6)). Under Article 14, they must report actively exploited vulnerabilities within 24 hours. The German BSI TR-03183-3 turns this into an organisational requirement: at least two roles, a PSIRT for products and services and a CSIRT for the company's own infrastructure, with role mailboxes psirt@ and csirt@. Except in microenterprises, these should not be the same people.
What it means for manufacturers
A small or medium-sized manufacturer does not need a team of its own, but it does need named roles with deputies: someone who reads the mailbox, someone who assesses a report technically and someone who is authorised to submit the notification to the authorities. The FIRST PSIRT Services Framework describes a distributed model for this, in which existing roles take on the PSIRT tasks. The key decision point is the one between "report received" and "exploitation confirmed", because the start of the 24-hour deadline depends on it. The TR also requires that no single analyst closes a report alone.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- CSIRT
- security.txt
- Coordinated vulnerability disclosure (CVD)
- Single point of contact for vulnerabilities
- Awareness (start of the deadlines)