210-255 · Question #113
Which function does an internal CSIRT provide?
The correct answer is C. incident handling services for a parent organization. An internal CSIRT exists within and serves only its own parent organization, distinguishing it from national, government, or commercial CSIRT types.
Question
Which function does an internal CSIRT provide?
Options
- Aincident handling services across various CSIRTs
- Bincident handling services for a country's government
- Cincident handling services for a parent organization
- Dincident handling services as a service for other organization
How the community answered
(63 responses)- A5% (3)
- B6% (4)
- C87% (55)
- D2% (1)
Why each option
An internal CSIRT exists within and serves only its own parent organization, distinguishing it from national, government, or commercial CSIRT types.
Coordinating incident handling across multiple independent CSIRTs is the role of a coordination or umbrella CSIRT, not an internal one.
Serving an entire country's government is the function of a national or governmental CSIRT, not an internal organizational team.
An internal CSIRT is established by and embedded within a specific organization to handle security incidents that affect that organization's own assets, personnel, and systems. Its authority and scope are bounded by the parent organization and it does not serve external clients or coordinate across independent teams. This is the defining characteristic that separates it from coordination, national, or commercial CSIRT models.
Providing incident response as a paid or outsourced service to other organizations describes a commercial CSIRT-as-a-Service model, which is external-facing by definition.
Concept tested: CSIRT types and organizational scope
Source: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.