Which of the following are core responsibilities of a national CSIRT and CERT?

Bug bounty programs are operated by private companies or third-party platforms to incentivize external researchers to find flaws in their own products, which is outside the public-service mandate of a national CSIRT or CERT.

National CSIRTs and CERTs are specifically chartered to serve their country's citizens and critical infrastructure by disseminating timely security vulnerability information and conducting security awareness training. Their core mandate is coordination and communication during incidents, not commercial or legislative activity. This aligns with the FIRST framework and standards like RFC 2350, which define the essential services of a national-level CSIRT.

Vulnerability brokering - buying and selling vulnerability information - is a commercial activity performed by private brokers, not a core function of a national CSIRT or CERT whose role is to coordinate and share, not trade, vulnerability data.

Creating cybersecurity regulations is a legislative and policy-making function belonging to government bodies or parliament, not to technical incident response teams such as CSIRTs or CERTs, which advise on but do not enact law.