Sources highlight the essential role of Computer Security Incident Response Teams (CSIRTs) in the context of cybersecurity incident reporting and response within the European Union (EU), as established by the NIS2 Directive. CSIRTs operate as specialized entities responsible for managing and mitigating cyber incidents, serving as fundamental points of contact for essential and important entities dealing with such incidents.

CSIRTs as the primary recipients of incident reports

• Designated reporting point: The NIS2 Directive requires essential and important entities to report significant cybersecurity incidents to their designated CSIRT or, where applicable, to the competent national authority. This designation underscores the central position of CSIRTs in the incident reporting ecosystem.
• Phased reporting process: The reporting process involves a multi-stage approach, requiring the submission of an early warning, a formal incident notification, and a final report. CSIRTs are the primary recipients of these reports, allowing them to monitor and assess the severity and potential impact of cyber incidents.
• Voluntary reporting: The Directive also encourages the voluntary reporting of incidents, cyber threats, and near-misses by entities both within and outside the scope of mandatory reporting. This expanded reporting scope further strengthens the role of CSIRTs in gathering cybersecurity information and promoting a proactive security culture.
• Information hub: CSIRTs act as information hubs, receiving incident reports, analyzing data, and disseminating relevant information to other stakeholders, including competent national authorities, other CSIRTs, and EU-level entities such as ENISA.

NIS2 Directive: The responsibilities of CSIRTs

• Guidance and support: Upon receiving an early warning, the CSIRT is obligated to provide initial feedback to the reporting entity and, upon request, offer guidance or operational advice on implementing mitigation measures.
• Coordinated response: CSIRTs play a key role in facilitating a coordinated response to significant incidents, particularly those with potential cross-border impact. They collaborate with other CSIRTs, competent national authorities, and EU-level bodies to contain the incident, mitigate its effects, and prevent its spread.
• Vulnerability management and disclosure: The NIS2 Directive designates a CSIRT in each Member State as a coordinator for vulnerability disclosure. This designated CSIRT acts as a trusted intermediary between entities that discover vulnerabilities and the vendors or service providers responsible for addressing them.
• Technical expertise: CSIRTs possess specialized technical expertise to analyze incidents, identify vulnerabilities, and provide tailored recommendations for their resolution. They also contribute to the development and maintenance of platforms and tools for secure information sharing.
• Collaboration with Law Enforcement: In the event of significant incidents suspected to be of a criminal nature, the CSIRT provides the reporting entity with guidance on how to report the incident to law enforcement authorities.

Strengthening CSIRT capabilities

• Resource allocation: Member States are required to ensure that each CSIRT has adequate resources, including financial, technical, and human resources, to effectively carry out its responsibilities. This includes having sufficient staff to ensure 24/7 availability and providing appropriate training opportunities, as well as participating in international cooperation networks.
• Infrastructure requirements: The NIS2 Directive mandates that CSIRTs maintain secure, resilient, and redundant communication infrastructure to facilitate the exchange of information with essential and important entities and other relevant parties. This includes avoiding single points of failure in their communication channels to ensure high availability.
• Peer reviews: To ensure a high level of capability and consistency across Member States, the Directive introduces peer reviews to examine the operational effectiveness of CSIRTs. These reviews are conducted by cybersecurity experts from other Member States, providing valuable insights and recommendations for improvement.

Importance of CSIRTs in the NIS2 Directive ecosystem

• Enhancing cyber resilience: By facilitating effective incident reporting and response, CSIRTs play a crucial role in improving the overall resilience of essential and important entities across the EU.
• Promoting a security culture: The collaborative nature of CSIRT work and their active involvement in information sharing foster a security culture and encourage proactive cybersecurity practices.
• Supporting EU cybersecurity goals: CSIRTs are fundamental to achieving the broader objectives of the NIS2 Directive regarding cybersecurity, contributing to a high level of security across the EU and a more resilient Digital Single Market.

Equipping CSIRTs with the necessary resources and fostering a culture of collaboration are two pillars upon which the NIS2 Directive builds a robust and effective cybersecurity ecosystem. For organizations falling within the scope of the directive, understanding the role of CSIRTs is the first step: the second is structuring a concrete NIS2 compliance roadmap that covers governance, technical measures, and reporting obligations. To learn more about the specific obligations related to the role of the contact person, it is also useful to read about the designation of the CSIRT contact person for NIS subjects and the distinction between the point of contact and the CSIRT contact person in ACN Determination no. 333017/2025. The full text of the legislation is available in the official NIS2 Directive document.

Frequently Asked Questions about CSIRTs and the NIS2 Directive

• Who is required to report incidents to the CSIRT?
• Essential and important entities falling within the scope of the NIS2 Directive are required to report significant incidents to their Member State’s designated CSIRT or, where applicable, to the competent national authority. Entities outside this scope may do so on a voluntary basis.
• What happens after an entity sends the early warning to the CSIRT?
• The CSIRT is required to provide timely initial feedback and, upon request, operational guidance on the mitigation measures to be adopted. In cases where the incident is of a criminal nature, the CSIRT also indicates how to involve the competent law enforcement authorities.
• How are the operational capabilities of CSIRTs guaranteed?
• Member States must ensure each CSIRT has adequate financial, technical, and human resources, 24/7 operational availability, and secure, redundant communication infrastructure. The Directive also provides for peer reviews conducted by experts from other Member States to verify and improve operational effectiveness.