text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: ENISA – CERT Inventory

text: ISBN 978-92-79-00077-5 doi:10.2788/14231

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: Albania Germany Norway Armenia Greece Poland Austria Hungary Portugal Azerbaijan Iceland Romania Belgium Ireland Russian Federation Bulgaria Israel Serbia Croatia Italy Slovakia Cyprus Latvia Slovenia Czech Republic Lithuania Spain Denmark Luxembourg Sweden Estonia Malta Switzerland Finland Moldova Turkey France Montenegro Ukraine Georgia Netherlands (The) United Kingdom

text: ENISA – CERT Inventory

text: DATE OF 2 FIRST NR. CERT NAME TI STATUS 3 CONSTITUENCY ADDITIONAL INFORMATION ESTABLISHMENT MEMBERSHIP

text: See: 1. Cisco CSIRT

text: Q1 199 Accredite Membe Commercial Organisatio http://tools.cisco.com/security/center/emergency.x?i

text: Cisco PSIRT 1995 Listed Member Vendor Customer Base See: http://www.cisco.com/go/psirt

text: Civil Society CERT Q1 2014 Listed Not member Non-Commercial Organisation

text: The European Grid Infrastructure (EGI) CSIRT provides an 4. operational response to security threats against the EGI EGI CSIRT Q1 2010 Certified Not member Research and Education

text: infrastructure. See: https://wiki.egi.eu/wiki/CSIRT

text: ESACERT 2003 Accredited Member Research and Education See: www.esacert.esa.int

text: Service Provider Customer IBM ERS Listed Member See: www.ers.ibm.com Base

text: ICANN CIRT Q4 2009 Listed Member Non-Commercial Organisation See: http://www.icann.org/en/cirt

text: Interpol Information Security Incident Response Team. See: Interpol ISIRT Q1 2009 Listed Member Non-Commercial Organisation

text: http://www.interpol.int Contact: isirt@interpol.int

text: See: www.trusted-introducer.org

text: See: www.first.org

text: ENISA – CERT Inventory

text: ISPIRIT Q1 2008 Listed Member Financial Sector

text: NATO Computer Incident Response Capability - Coordination 10. Centre (located in Belgium). See: NCIRC CC Listed Member Military

text: Cooperation initiative between Nordic national research NORDUnet CERT Q3 1990 Accredited Member Research and Education

text: networks. See: http://cert.nordu.net

text: Panasonic PSIRT Q2 2010 Accredited Member Vendor Customer Base See: http://panasonic.co.jp/info/psirt/en/ 13. RIPE NCC CSIRT Q4 2103 Listed Not Member Non-Commercial Organisation 14. Shell SecOps Q1 2004 Not Listed Member Commercial Organisation Contact: cert@shell.com 15. Team Cymru Q1 1998 Accredited Member Commercial Organisation See: http://www.team-cymru.org

text: DATE OF NR. CERT NAME TI STATUS FIRST MEMBERSHIP CONSTITUENCY ADDITIONAL INFORMATION ESTABLISHMENT

text: AiG CERT Q2 2013 Accredited Not member Commercial Organisation cert@airbus.com 17. CERT-EU Q2 2011 Accredited Not member National /Governmental See: www.cert.europa.eu GSC Network Defence Primary constituency: General Secretariat of the Council of 18. Q2 2009 Not listed Not member National /Governmental Capability the EU

text: ENISA – CERT Inventory

text: ALCIRT Q3 2011 Listed Not member Governmental Contact: contact@cirt.gov.al

text: CERT AM Listed Not member National / Governmental See: www.cert.am

text: ACOnet-CERT Q1 2003 Accredited Member Research and Education See: http://cert.aco.net 22. CERT.AT Q1 2008 Accredited Member National See: www.cert.at 23. GovCERT Q2 2008 Listed Not Member Governmental See: www.govcert.gv.at 24. R-IT CERT Q1 2008 Listed Member Financial Sector See: www.r-it.at 25. WienCERT Q3 2011 Listed Not Member Governmental City of Vienna – Contact: cert@wien.gv.at

text: ENISA – CERT Inventory

text: National, Research and 26. AZ-CERT Q1 2011 Accredited Not member See: www.cert.az Education 27. CERT.GOV.AZ Q1 2008 Accredited Not member Military, Governmental See: www.cert.gov.az 28. CERT AzEduNET Listed Not member Research and Education 29. CSC Az Listed Not member Governmental See: http://www.cert.az/

text: CERT.BE merged with previous BELNET CERT in Q3 2011. See: 30. CERT.BE Q3 2004 Accredited Member National / Governmental

text: GSC-NDC-OC Q2 2009 Listed Not Member Government. - Military 32. PXS-CSIRT Q1 2011 Accredited Member Commercial Organisation See: csirt@proximus.com

text: CERT Bulgaria Q4 2008 Accredited Not member National / Governmental See: https://govcert.bg

text: ENISA – CERT Inventory

text: CERT ZSIS Q3 2007 Accredited Member Governmental See: www.zsis.hr 35. HR-CERT Q2 2009 Accredited Member National See: www.cert.hr

text: CYPRUS Research and 36. Listed Not member Research and Education Academic

text: 2CCSIRT Q2 2014 Listed Not member ISP Customer Base Service Provider 38. ACTIVE24-CSIRT Listed Not member See: www.active24.cz/csirt Customer Base Commercial 39. ALEF-CSIRT Q4 2014 Listed Not member abuse@alef.com Organisation 40. CASABLANCA.CZ-CSIRT Listed Not member ISP Customer Base See: http://csirt.casablanca.cz/ 41. CDT-CERT Q2 2014 Listed Not member ISP Customer Base Research and 42. CESNET-CERTS Q1 2004 Accredited Not member See: www.cesnet.cz/csirt Education 43. CSIRT Merit Q1 2015 Listed Not member ISP Customer Base abuse@merit.cz Service Provider 44. Coolhousing CSIRT Q3 2014 Listed Not member Customer Base 45. CSIRT.CZ Q2 2008 Accredited Not member National CERT See: www.csirt.cz

text: ENISA – CERT Inventory

text: Research and 46. CSIRT-MU Q2 2009 Accredited Not member See: www.muni.cz/csirt Education Research and 47. CSIRT-VUT Q1 2009 Listed Not member See: http://csirt.vutbr.cz/ Education 48. CSOB-Group-CSIRT Q1 2011 Listed Not member Financial Sector Formerly CZNIC-CSIRT. Non Commercial 49. CZ.NIC-CSIRT Q2 2008 Accredited Not member Organisation

text: See: www.nic.cz/csirt

text: GOVCERT.CZ Q3 2012 Accredited Not member Governmental See: www.govcert.cz 51. KAORA-CSIRT Q4 2014 Listed Not member ISP Customer Base csirt@kaora.cz 52. O2.cz CERT Q4 2013 Listed Not member ISP Customer Base abuse@O2.cz 53. SEBET Q3 2014 Listed Not member ISP Customer Base csirt@itself.cz 54. SEZNAM.CZ-CSIRT Q3 2013 Listed Not member ISP Customer Base See: http://napoveda.seznam.cz/csirt/ 55. ISPA CSIRT 1/1/2015 Listed Not member ISP Customer Base csirt@ispalliance.cz 56. FORPSI-CSIRT 1/3/2015 Listed Not member ISP Customer Base csirt@forpsi.com 57. WEB4U-CSIRT 1/6/2015 Listed Not member ISP Customer Base csirt@web4u.cz

text: Danish GovCERT Q2 2009 Accredited Member National / Governmental See: www.govcert.dk 59. CSIRT.DK Q4 1999 Listed Member ISP Customer Base See: www.csirt.dk 60. DKCERT Q3 1991 Accredited Member Research and Education See: www.cert.dk Service Provider Customer 61. KMD IAC Q3 1997 Listed Member See: www.kmd.dk Base 62. SECUNIA RESEARCH Q4 2002 Listed Member ICT Vendor Customer Base 63. SWAT Not listed Not member Commercial Organisation A.P. Moller-Maersk Group IT-Security SWAT

text: ENISA – CERT Inventory

text: CSIS.DK Q1 2003 Not listed Not member Commercial Organisation See: www.csis.dk

text: CERT-EE Q1 2006 Accredited Member National / Governmental See: www.cert.ee 66. EDF CIRC Q1 2009 Listed Not member Military

text: Accredited and 67. NCSC-FI Q1 2002 Member National / Governmental See: www.cert.fi Certified 68. Ericsson PSIRT Q1 2004 Accredited Member ICT Vendor Customer Base Contact: psirt@ericsson.com F-Secure Security 69. Listed Not member Commercial Organisation See: www.f-secure.com Response 70. Funet CERT Q3 1995 Accredited Member Research and Education See: www.cert.funet.fi Also located in the UK, USA, China, Denmark, Singapore and 71. Nokia NIRT Q3 1998 Listed Member ICT Vendor Customer Base Australia.

text: ENISA – CERT Inventory

text: Service Provider Customer 72. AlliaCERT Q1 2012 Listed Not member See: cert@alliacom.com Base 73. CERT SEKOIA Q2 2015 Listed Not member Commercial Organisation See: cert@sekoia.fr 74. CERT BDF Q4 2012 Listed Not member Financial Sector 75. CERT-BULL Q3 2013 Listed Not member Commercial Organisation 76. CERT Credit Agricole Listed Not member Financial Sector See: cert@credit-agricole.com 77. CERT-FR Q4 1999 Accredited Member National / Governmental See: www.cert.ssi.gouv.fr Service Provider Customer Formerly APOGEE SecWatch. See: www.cert- 78. CERT-DVT Q3 2007 Accredited Not member

text: Base devoteam.com

text: Service Provider Customer 79. Cert-IST Q1 1999 Accredited Member See: www.cert-ist.com Base Service Provider Customer 80. CERT-LEXSI Q2 2003 Accredited Member See: http://cert.lexsi.com Base 81. CERT-Renater Q1 1993 Accredited Member Research and Education See: www.renater.fr 82. CERT-Société Générale Listed Member Financial Sector See: http://cert.societegenerale.com Service Provider Customer 83. CERT-XMCO Listed Not member See: www.xmcopartners.com Base 84. CSIRT BNP Paribas Listed Not member Financial Sector 85. CERT LA POSTE Listed Not member Financial Sector

text: ENISA – CERT Inventory

text: See: http://www.solucom.fr/index.php/Nos-savoir-

text: Service Provider Customer 86. CERT-SLC Q1 2011 Accredited Not Member faire/Risk-management-securite-de-l- Base

text: Orange-CERT-CC Listed Member Commercial Organisation Commercial Organisation. - 88. CERT-UBIK Listed Not member Service Provider Customer team@cert-ubik.com Base 89. CERT OSIRIS 1/1/2012 Listed Not member Research & Education cert-osiris@unistra.fr

text: CERT-GOV-GE Accredited Not member National / Governmental See: www.dea.gov.ge 91. CERT-GE Q1 2007 Listed Not member Research and Education See: www.cert.ge

text: AiG CERT Q2 2013 Accredited Member Commercial Organisation See: http://www.cybersecurity-airbusds.com 93. BFK Not listed Member Commercial Organisation See: www.bfk.de 94. BASF gCERT Q1 2010 Listed Member Commercial Organisation Contact: cert@basf.com 95. CERT BWI Q1 2008 Certified Member ICT Vendor Customer Base See: www.bwi-systeme.de

text: ENISA – CERT Inventory

text: CERT-BUND Q1 2001 Accredited Member National /Governmental See: www.cert-bund.de 97. CERT-rlp Not listed Not Member Governmental See: www.cert-rlp.de 98. CERTBw Q2 2003 Listed Member Military, Governmental 99. CERT NRW Q1 2005 Listed Not Member Government 100. CERT-VW Q3 2002 Accredited Member Commercial Organisation 101. ComCERT Q2 2002 Listed Member Financial Sector See: www.commerzbank.com CSIRT European Central Bank 102. CSIRT-ECB Q1 2012 Listed Member Financial Sector

text: Contact: csirt@ecb.europa.eu

text: dbCERT Q4 2003 Not listed Member Financial Sector See: www.db.com Service Provider Customer 104. dCERT Q1 1999 Accredited Member See: www.dcert.de Base 105. DFN-CERT Q1 1993 Certified Member Research and Education See: www.dfn-cert.de 106. Evonik CERT Q3 2012 Listed Not member Commercial Organisation See: http://www.evonik.com/ Provides services to the customers of Fujitsu Technology 107. FTS-CERT Not listed Member Vendor Customer Base Solutions. 108. KIT-CERT Q1 2008 Accredited Member Research and Education See: www.kit.edu/cert Service Provider Customer 109. PRE-CERT Q1 2001 Accredited Member See: www.pre-secure.de Base 110. RUS-CERT Q1 1998 Accredited Member Research and Education See: http://cert.uni-stuttgart.de 111. SAP CERT Q1 2002 Listed Member ICT Vendor Customer Base 112. S-CERT Q1 2001 Accredited Member Financial Sector See: www.s-cert.de Service Provider Customer 113. SECU-CERT Q3 2001 Listed Member Base 114. Siemens-CERT Q2 1998 Accredited Member Industrial Sector Also located in the USA.See: www.siemens.com/cert 115. TK CERT Q1 2012 Listed Not member Commercial Organisation ThyssenKrup 116. Vodafone-CERT Q4 2009 Listed Member ISP Customer Base

text: ENISA – CERT Inventory

text: See: 117. XING Q2 2011 Accredited Not member Commercial Organisation https://corporate.xing.com/english/company/security

text: Bayern-CERT 01/04/2004 Listed Not member Government mailto:cert@bayern.de 119. E.ON CERT 01/02/2012 Accredited Not member Commercial Organisation CERT@eon.com

text: NCERT-GR Listed Not member National / Governmental See: www.cert.gov.gr 121. AUTH-CERT Q2 2004 Listed Not member Research and Education See: www.auth.gr Service Provider Customer 122. FORTHcert Q3 2007 Certified Member See: www.forth.gr/forthcert Base 123. GRNET-CERT Q2 2000 Accredited Not member Research and Education See: http://cert.grnet.gr

text: CERT-Hungary Q1 2005 Accredited Member National / Governmental See: www.cert-hungary.hu 125. HUN-CERT Q4 2003 Listed Not member Major Service Provider See: www.cert.hu 126. NIIF CSIRT Q4 2003 Listed Not member Research and Education See: http://csirt.niif.hu

text: ENISA – CERT Inventory

text: CERT.IS Q4 2012 National / Governmental See: http://www.cert.is 128. RHnet CERT Q4 2003 Listed Not member Research and Education

text: DATE OF NR. CERT NAME ESTABLIS TI STATUS FIRST MEMBERSHIP CONSTITUENCY ADDITIONAL INFORMATION HMENT

text: CSIRT.IE Not listed Not member National / Governmental 130. HEANET-CERT Q4 2002 Listed Not member Research and Education See: www.heanet.ie/cert.html 131. IRISS CERT Q4 2008 Accredited Not member Non Commercial Organisation See: www.iriss.ie 132. POPCAP-CSIRT Listed Not member Vendor Customer Base

text: CERTGOVIL Q2 2006 Listed Member National / Governmental See: http://www.cert.gov.il

text: ENISA – CERT Inventory

text: National, Research and 134. IUCC-CERT Not Listed Member See: http://cert.iucc.ac.il/ education

text: CERT-Difesa Not listed Not member Military See: cert.difesa.it 136. CERT Nazionale Q3 2014 Not listed Not member National / Governmental See: https://www.certnazionale.it CERT Publicca 137. Q1 2014 Not listed Not member National / Governmental Amministrazione Accreditation Service Provider Customer 138. PI-CERT Q1 2013 Not member See: http://www.picert.it Candidate Base Local agencies for the Friuli 139. CERT-RAFVG Not listed Not member See: http://cert-rafvg.regione.fvg.it region 140. GARR-CERT Q1 1999 Accredited Not member Research and Education See: www.cert.garr.it Covers all sites of Telecom Italia. See: 141. S2OC Not listed Not member ISP Customer Base

text: Dioceses of the Catholic 142. SICEI-CERT Not listed Not member Formerly SOC-IDS-CEI. See: http://cert.chiesacattolica.it Church 143. IT-CERT 5/6/2014 Listed Not member Government, National mailto:cert@mise.gov.it

text: CERT.LV Q3 2006 Accredited Member National / Governmental See: www.cert.lv

text: ENISA – CERT Inventory

text: CERT-LT Q4 2006 Accredited Member National / Governmental See: www.cert.lt and www.esaugumas.lt 146. SVDPT-CERT Q2 2008 Accredited Not member Governmental Formerly IST-SVDPT See: www.svdpt.gov.lt 147. LTU MOD CIRT Listed Member Military See: www.kam.lt 148. LITNET CERT Q2 1998 Accredited Member Research and Education See: https://cert.litnet.lt Service Provider Customer 149. NRD CIRT Q1 2014 Listed Member See: https://www.nrdcs.lt Base

text: Service Provider Customer 150. CERT-XLM Q1 2014 Listed Not member See: http://www.excellium-services.com/ Base 151. DVG-CERT Q3 2014 Listed Not member Financial Sector 152. GOVCERT.LU Q2 2011 Accredited Not member Governmental CERT See: www.govcert.lu 153. CIRCL Q1 2008 Accredited Member National CERT See: www.circl.lu CSRRT-LU is a computer security research and response team 154. CSRRT-LU Not listed Not member Research and Education association based in the Grand-Duchy of Luxembourg. See:

text: HealthNet Q1 2014 Listed Not member Governmental See: http://www.healthnet.lu/ Service Provider Customer 156. Malware.lu CERT Q4 2012 Accredited Not member See: http://www.malware.lu Base 157. RESTENA-CSIRT Q1 2008 Accredited Not member Research and Education See: www.restena.lu/csirt

text: ENISA – CERT Inventory

text: Telindus-CSIRT Not specified Commercial Organisation, ISP Commercial Organisation, ISP Customer mailto:csirt@telindus.lu 3 158. Listed Not member Not specified not member Customer Base listed Base mailto:csirt@telindus.lu Telindus-CSIRT 1 lu

text: CSIRT Malta Q1 2013 Not Listed Not member National See: http://csirtmalta.org Accreditation 160. mtCERT Q3 2002 Not member Governmental See: www.mtcert.gov.mt Suspended

text: ENISA – CERT Inventory

text: MD-CERT Listed Not member Research and Education See: www.cert.md

text: CIRT.ME Q3 2011 Listed Member National See: www.cirt.me

text: AAB GCIRT Q4 2001 Listed Member Financial Sector See: www.abnamro.com 164. AMC-CERT Q3 2000 Listed Not member Research and Education Service Provider Customer 165. CERT-IDC Q3 2001 Listed Not member Base 166. CERT-RU Q4 2001 Listed Not member Research and Education See: www.ru.nl 167. CERT-RUG Q1 2002 Accredited Not member Research and Education See: www.rug.nl 168. CERT-UU Q3 2000 Listed Not member Research and Education 169. DefCERT Q4 2010 Listed Member Military See: www.defcert.nl 170. Edutel-CSIRT Listed Not member ISP Customer Base See: www.edutel.nl 171. FoxCERT Q1 2012 Accredited Not member Commercial Organisation See: http://www.foxcert.com 172. IBD Q1 2013 Accredited Not member Governmental See: http://www.IBDgemeenten.nl/ 173. ING Global CIRT Q4 2006 Listed Member Financial Sector

text: ENISA – CERT Inventory

text: Accredited and 174. KPN-CERT Q2 1995 Member ISP Customer Base See: www.kpn-cert.nl Certified Accredited and 175. NCSC-NL Q2 2002 Member National / Governmental See: http://www.ncsc.nl Certified 176. RABOBANK SOC Q2 2008 Listed Member Financial Sector See: www.rabobank.nl 177. SURFcert Q4 1992 Accredited Member Research and Education See: http://cert.surfnet.nl 178. UvA-CERT Q3 2000 Listed Not member Research and Education See: http://ic.uva.nl/cert

text: DnB IRT Q2 2008 Not listed Member Financial Sector See: www.dnb.no 180. FinansCERT Q2 2014 Not listed Member Financial Sector See: http://www.finanscert.n 181. HelseCSIRT Q4 2014 Not listed Member Governmental See: http://www.nhn.no 182. mIRT Q1 2002 Not listed Member ICT Vendor Customer Base See: http://mnemonic.no 183. NorCERT Q2 2004 Accredited Member National / Governmental See: www.cert.no 184. Statoil CSIRT Q4 2008 Not listed Member Commercial Organisation See: www.statoil.com 185. Telenor CERT Q2 2010 Not listed Member Major Service Provider See: www.telenor.com 186. UiO-CERT Q2 2005 Accredited Member Research and Education See: http://cert.uio.no 187. UniNett CERT Q2 1995 Accredited Member Research and Education See: http://cert.uninett.no

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: CERT Orange Polska ISP Customer Base Accredited Not member ISP Customer Base 189. CERT POLSKA Q1 1996 Accredited Member De Facto National See: www.cert.pl 190. CERT.GOV.PL 2008 Listed Not member Governmental CERT See: www.cert.gov.pl 191. ComCERT.PL Q1 2015 Listed Not member Commercial Organisation See: 192. PIONIER-CERT Listed Not member Research and Education Formerly POL34-CERT. See: http://cert.pionier.gov.pl 193. TP CERT Listed Member ISP Customer Base See: http://www.orange.pl/cert.phtml

text: CERT.PT Q3 2002 Accredited Member De Facto National See: www.cert.pt 195. DGS-IRT Q1 2005 Accredited Not member Vendor Customer Base See: www.dognaedis.com 196. CSIRT.FEUP Q1 2006 Accredited Not member Research and Education See: http://csirt.fe.up.pt 197. csirtPT Q1 2010 Accredited Not member ISP Customer Base See: http://csirt.telecom.pt

text: CERT-RO Q2 2011 Listed Not member National / Governmental See: www.cert-ro.eu 199. CORIS-STS Q1 2008 Accredited Not member Governmental CERT See: https://corisweb.stsisp.ro 200. RoCSIRT Q1 2009 Accredited Member Research and Education See: www.csirt.ro 201. STI CERT Q1 2012 Listed Not member Commercial Organization cert@safetech.ro

text: ENISA – CERT Inventory

text: UTI CERT Q3 2014 Listed Not member Commercial Organisation csirt@uti.ro 203. STI CERT 01/03/2012 Listed Not member National / Governmental mailto:cert@safetech.ro

text: Service Provider Customer 204. CERT-GIB Listed Not member See: www.cert-gib.com Base 205. RU-CERT Q1 1998 Accredited Member Research and Education See: www.cert.ru 206. WebPlus ISP Q4 2000 Listed Not member ISP Customer Base See: http://support.wplus.net

text: AMRES-CSIRT Listed Not member Research and Education See: http://csirt.amres.ac.rs

text: CSIRT.SK Q3 2009 Accredited Not member National / Governmental See: www.csirt.gov.sk

text: ENISA – CERT Inventory

text: National / Governmental, 209. SI-CERT Q4 1994 Accredited Member See: www.cert.si Research and Education

text: AndaluciaCERT Listed Not member Governmental 211. CN-CERT Q4 2006 Accredited Member National / Governmental See: www.ccn-cert.cni.es 212. CERTSI Q2 2007 Accredited Member National incidencias@certsi.es

text: CSUC-CSIRT Q1 2011 Listed Not Member Research & Education

text: CERTSI Q2 2007 Accredited Member National incidencias@certsi.es 215. CESICAT-CERT Q1 2010 Accredited Member Governmental See: www.cesicat.cat 216. COSDEF-CERT Q4 2011 Listed Not member Military Contact: cosdef-cert@oc.mde.es Service Provider Customer 217. CyberSOC-CERT Q4 2012 Not Listed Not member See: https://cybersoc.deloitte.es/ Base 218. CSIRTCV Q2 2007 Accredited Not member Governmental See: www.csirtcv.es 219. e-LC CSIRT Q1 2005 Listed Member Financial Sector 220. esCERT-UPC Q4 1994 Accredited Member Research and Education See: http://escert.upc.edu 221. Incita Security CERT Q1 2006 Listed Member Vendor Customer Base See: http://www.tb-security.com/ 222. INTECO-CERT Q2 2007 Accredited Member National / Governmental See: http://cert.inteco.es 223. IRIS-CERT Q4 1995 Accredited Member Research and Education See: www.rediris.es/cert 224. MAPFRE-CCG-CERT Listed Member Financial Sector Service Provider Customer 225. S21sec CERT Q1 2000 Accredited Member See: https://cert.s21sec.com Base 226. TBSecurity-CERT Q1 2006 Not listed Member ICT Vendor Customer Base See: www.tb-security.com

text: ENISA – CERT Inventory

text: See: Service Provider Customer

text: Telefonica-CSIRT Q4 2005 Listed Member http://www.internationalservices.telefonica.com/csirt

text: Service Provider Customer 228. 2S-CSIRT Q1 2011 Listed Not member See: http://www.2secure.se/ Base 229. BF-SIRT Q1 2012 Listed Member ISP Customer Base See: http://www.basefarm.com/ Accredited and 230. CERT-SE Q1 2003 Member National / Governmental See: www.cert.se Certified 231. FM CERT Q1 2002 Listed Not member Military See: http://www.forsvarsmakten.se/ 232. Handelsbanken SIRT Q1 2006 Accredited Not member Financial Sector Accredited and 233. LiU IRT Q1 2007 Not member Research and Education See: www.liu.se Certified 234. SIST Listed Not member Research and Education See: www.snic.vr.se 235. SUNet CERT Q4 2000 Accredited Member Research and Education See: www.cert.sunet.se 236. Swedbank SIRT Q3 2003 Accredited Not member Financial Sector Accredited and Service Provider Customer Also located in Finland, Denmark, Norway, Latvia and 237. TS-CERT Q1 1997 Member Certified Base Lithuania. See: www.teliasonera.com 238. UU-CSIRT Q1 2001 Accredited Not member Research and Education csirt@uu.se

text: ENISA – CERT Inventory

text: BVCERT Q1 2011 Listed Not member Financial Sector See: http://www.vontobel.ch/ 240. CERN CERT Listed Not member Research and Education See: http://cern.ch/security 241. ETHZ-NSG Q1 1996 Accredited Not member Research and Education 242. GovCERT.CH Q1 2008 Accredited Member Governmental See: www.melani.admin.ch Service Provider Customer 243. IP+ CERT Q1 1995 Listed Member Base Service Provider Customer 244. OS-CIRT Listed Member Base Accredited and 245. SWITCH-CERT Q1 1995 Member De facto national See: www.switch.ch/cert Certified 246. Swisscom CSIRT Q1 1995 Not listed Member ISP Customer Base See: csirt@swisscom.com Service Provider Customer 247. UPCCH Abusedesk Listed Member Formerly CC-SEC Base

text: BGA-CSIRT Q2 2014 Accredited Not member Commercial Organization cert@bga.com.tr 249. SignalSEC Research Q1 2011 Listed Not member Commercial Organization cert@signalsec.com 250. TR-CERT Q2 2007 Accredited Not member National / Governmental See: www.usom.gov.tr 251. Ulak-CSIRT Q2 2005 Accredited Not member Research and Education See: http://csirt.ulakbim.gov.tr

text: ENISA – CERT Inventory

text: CERT-UA Listed Member Military, Governmental See: www.cert.gov.ua

text: BTCERTCC Q1 1999 Accredited Member ISP Customer Base 254. Bunker Q1 2004 Not listed Member ISP Customer Base See: www.thebunker.net Service Provider Customer 255. CIS-CERT Q1 1998 Listed Member See: www.contextis.co.uk Base 256. CITIGROUP Q3 2000 Listed Not member Financial Sector Also located in the USA. 257. CERT-UK Q1 2014 Listed Member National See: www.cert.gov.uk 258. DAN-CERT Q1 1999 Accredited Member Research and Education See: www.dante.net/dancert 259. DCSIRT Q3 2005 Listed Member Commercial Organisation 260. E-CERT Q1 2002 Listed Not member ISP Customer Base 261. ESISS Q2 2009 Accredited Not member ISP Customer Base See: www.esiss.ac.uk 262. EUCS-IRT Q2 2002 Listed Not member Research and Education 263. GovCertUK Q1 2007 Listed Member National / Governmental See: www.govcertuk.gov.uk 264. Janet CSIRT Q1 1993 Not listed Not member Research and Education See: https://www.jisc.ac.uk/esiss 265. KPMG-CSIRT Q2 2001 Listed Member Commercial Organisation See: www.kpmg.co.uk/cyber 266. MLCIRT Listed Not member Financial Sector Also located in the USA. 267. MODCERT Listed Member Military, Governmental See: www.mod.uk 268. NGRID-CSIRT Q2 2011 Not listed Member Energy Sector See: www.nationalgrid.com 269. OxCERT Listed Member Research and Education See: www.ox.ac.uk

text: ENISA – CERT Inventory

text: P-CIRF Q4 1992 Not listed Member Commercial Organisation See: www.portcullis-security.com Service Provider Customer 271. Q-CIRT Listed Member See: www.qinetiq.com Base Also located in Australia, Belgium, France, Germany, Gibraltar, Hong Kong, India, Ireland, Italy, Japan, Monaco, the 272. RBSG-ISIRT Q4 2003 Listed Member Financial Sector Netherlands, Singapore and the USA.

text: See: www.rbs.co.uk

text: UCL CERT Q3 2001 Listed Not Member Research & Education Contact: cert@ucl.ac.uk 274. WAR-CSIIRT Listed Member Research and Education See: www.warwick.ac.uk 275. GEANT CERT Q1 1999 Certified Members Research and Education dancert@dante.net

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text: ENISA – CERT Inventory

text:  Changed TI-Status and URL of Cert-IST (France)  Changed TI-Status, URL and FIRST membership of CERT-Hungary (Hungary)  Changed the URL of GovCERT.IT (Italy)  Added team and text about CERT Estonia (Estonia)  Added team and text about Ulak-CSIRT (Turkey)  Updated text about E-Coat (CERT co-operation activities and projects in Europe)  Updated text about TF-CSIRT (CERT co-operation activities and projects in Europe)  Updated text about SIRIOS (CERT supporting activities and projects)  Added text about NCIRC NATO Cyber Defence Workshops (International cooperation)  Added SWITCH CERT as a new member in EGC  Updated team name Ericsson PSIRT (Formerly ETSIRT), TI-Status, TI-URL, and Constituency  Updated TI-Status, URL and Constituency of NorCERT  Added team and text about LATNET CERT (Latvia)  Added team and text about CERT-RRT (Lithuania)  Updated team name RBSG-ISIRT (UK, from RBSG), TI-Status, TI-URL, and Constituency  Added team and text about BP DSAC (UK)  Added team and text about SAP CERT (Germany)

text:  Updated text about SIRIOS (CERT supporting activities and projects)  Added Dutch national cooperation (o-IRT-o) (CERT co-operation activities and projects in Europe)  Removed team CERT-AM(11) (Italy) as this group is now considered the constituency of GovCERT.it  Removed team MBDA SMT (Italy) due to the lack of publicly available contact information  Removed team OPS-Security (Italy) as it was absorbed by Telecom Italia (S2OC)  Updated constituency information for GovCERT.it (Italy) to include CERT-AM(21)  Updated the URL of CERT ENEL (Italy)  Updated the URL of CERT-RAFVG (Italy)  Updated the URL of S2OC (Italy)  Updated the URL and team name of SOC-IDS-CEI (Italy) to SICEI-CERT  Updated team name of Abuse TP S. A. (Poland) to TP CERT (http://www.tp.pl/cert)  Added IRT symbol on the map next to the teams that take use of the RIPE IRT Object

text:  Added team and text about CSIRT.FEUP (Portugal)  Added team and text about CCN-CERT (Spain)  Added team and text about INTECO CERT (Spain)  Added team and text about DDIRV (Latvia)  Added team and text about DCSIRT (UK)  Added team and text about GovCertUK (UK)  Changed NorCERT (Norway) to TI status “Accredited”

text: ENISA – CERT Inventory

text:  Changed Ulak-CSIRT (Turkey) to TI status “Accredited”  Changed team name of JANET-CERT (UK) to JANET CSIRT  Changed team name of BT SBS (UK) to BTGS  Changed team name of UNIRAS (UK) to CPNI and updated the text  Changed the URL of EGC (European Government CERT Group)  Removed PERMALAN (no longer listed on FIRST)  Removed mCERT (has ceased to exist)

text:  Removed BTGS (UK), no longer operational according to TI  Removed CSRRT-LU (Luxembourg), seems no longer operational  Moved SKY-CERT (UK) to SKY-CERT (Estonia) based on TI listing change  Changed team name of CERT Estonia (Estonia) to CERT-EE based on TI listing  Changed team name of LATNET CERT (Latvia) to CERT NIC.LV and updated the text  Added team and text about CERT GOV PL (Poland) www.cert.gov.pl  Added team and text about CERT.AT (Austria) www.cert.at  Added team and text about RESTENA-CSIRT (Luxembourg) www.restena.lu/csirt/  Added team and text about CERT-IPN (Portugal) www.cert.ipn.pt  Added team and text about e-LC CSIRT (Spain) based on FIRST database  Added team and text about ING Global CSIRT (Netherlands)based on TI listing and FIRST database  Added team and text about UIO-CERT (Norway) based on TI listing  Fixed URLs of CERT-Difesa and CERT-RAFVG (Italy)  Added TI status and Link to GovCertUK (UK)  Added Latvian national cooperation (LV CERT) (CERT co-operation activities and projects in Europe)

text:  Re-inserted team CSRRT-LU (Luxembourg) based on Luxembourg National Liaison Officer feedback  Added team and text about CIRCL (Luxembourg) based on Luxembourg National Liaison Officer input and TI listing  Added team and text about FORTH CERT (Greece) based on direct input and TI listing  Added team and text about CSIRT.CZ (Czech Republic) based on direct input and TI listing  Added team and text about CZNIC-CSIRT (Czech Republic) based on TI listing  Added team and text about RoCSIRT (Romania) based on TI listing  Added team and text about CSIRTCV (Spain) based on direct input from Spanish officials and TI listing  Changed team name of CPNI (UK) to CSIRTUK based on TI database update  Changed team name and text of Micro-BIT (Germany) to BFK based on DFN-CERT input and FIRST database  Changed team name and text of CERT-RRT (Lithuania) to CERT-LT (www.cert.lt) based on the input from the Lithuanian National Liaison Officer  Updated team information of CERT-IPN (Portugal) based on direct input and TI listing  Updated following teams to “TI accredited”: CERT-EE, CERT NIC.LV, TR-CERT, Ulak-CSIRT, INTECO-CERT

text:  Changed team info: RESTENA-CSIRT (Luxembourg) has finished the accreditation process successfully  Added team and text about IRISS CERT (Ireland) based on TI listing  Added team and text about CERT ZSIS (Croatia) based on TI listing  Added team and text about CERT Bulgaria (Bulgaria) based on TI listing  Added team and text about Jumper CSIRT (Ireland) based on TI listing  Added team and text about POPCAP-CSIRT (Ireland) based on TI listing  Added team and text about CERT-LT (Lithuania) based on TI listing  Changed text of RM CSIRT (UK) the whole name in breakages and added URL  Updated the TI URL& web URL of Cisco PSIRT (UK)  Updated the TI URL of BTCERT CC (UK)

text: ENISA – CERT Inventory

text:  Updated the TI URL of CERT PT (Portugal)  Updated the TI URL of Uninett CERT (Norway)  Added the FIRST URL of AAB-GCIRCT (Netherlands)  Updated the web URL of OxCERT (UK)  Changed team name of SURFnet-CERT (Netherlands) to SURFCERT based on TI database update  Updated the web URL of CERT Renater (France)  Added the FIRST URL of FSC-CERT (Germany)  Updated the URL of GNS-CERT (Germany)  Added the FIRST URL of BFK (Germany)  Updated the web URL of PRE-CERT(Germany)  Changed team info: FORTH CERT (Greece) has finished the accreditation process successfully  Added the web URL of RoCSIRT (Romania)  Added the web URL of esCERT-UPC (Spain)  Updated the TI URL of GOVCERT.NL (Netherlands)  Updated the URL of SURFnet CERT (Netherlands)  Activated the web URL of Ulak-CSIRT (Turkey)  Deleted the web URL of BT CERT CC (United Kingdom)  Updated the web URL of JANET-CSIRT (United Kingdom)  Changed country name from The Netherlands to Netherlands (The)  Changed location of NCIRC CC (Belgium) to “International”  Changed team info to accredited: DDIRV (Latvia)  Changed team info to accredited: CERT-LT (Lithuania) , added TI URL  Changed team info to accredited: RBSG-ISIRT (UK)  Updated the web URL of HEANET (Ireland)  Added the TI URL of RESTENA (Luxembourg)

text:  Added team and text about IST-SVDPT (Lithuania) based on TI listing  Added team and text about KIT-CERT (Germany) based on TI listing  Added team and text about CERT.BE (Belgium) based on TI listing  Added team and text about SIST (Sweden) based on TI listing  Added team and text about R-IT-CERT (Austria) based on TI listing  Added team and text about CERT-Société Générale (France) based on TI listing  Added team and text about HR-CERT (Croatia) based on TI listing  Added team and text about EGEE OSCT (International) based on TI listing  Added team and text about CSIRT-MU (Czech Republic) based on TI listing  Added team and text about CERT-UA (Ukraine) based on TI listing  Added team and text about CERT AzEduNET (Azerbaijan) based on TI listing  Added team and text about CERT-GE (Georgia) based on TI listing  Deleted team and text about T-COM-CERT (Germany) based on received info  Added team and text about GOVCERT (Austria) based on Austria’s request  Added team and text about SWAT (Denmark) based on FIRST membership  Added team and text about SECUNIA (Denmark) based on FIRST membership  Added team and text about FSLabs (Finland) based on FIRST membership  Added team and text about ISIRT (France) based on FIRST membership  Added team and text about RABOBANK (Netherlands) based on FIRST membership  Added team and text about IRT-Edutel-CSIRT (Netherlands) based on IRT entry/request  Changed team info to accredited: FORTH CERT (Greece)  Updated the web URL of HEANET CERT (Ireland)  Changed constituency info: IRIS-CERT (Spain)  All URLs updated (TI, FIRST)

text: ENISA – CERT Inventory

text:  All constituency descriptions change to “sector” description  Added team and text about APOGEE SecWatch (France) based on TI listing

text:  Changed status about KIT-CERT (Germany) based on TI listing  Added team and text about Edutel-CSIRT (Netherlands) based on TI listing  Added team and text about CSIRT BNP Paribas (France) based on TI listing  Changed status about HR-CERT (Croatia) based on TI listing  Changed status about CERT.BE (Belgium) based on TI listing  Added team and text about Swedbank SIRT (Sweden) based on TI listing  Changed status about IRISS CERT (Ireland) based on TI listing  Changed information about CSIRT-MU (Czech Republic) based on TI listing  Changed information about UiO CERT (Norway) based on TI listing  Changed information about INTECO-CERT (Spain) based on TI listing  Changed information about NorCERT (Norway) based on TI listing  Changed information about R-IT CERT (Austria) based on TI listing  Changed location about ESACERT (Worldwide) based on TI listing  Added text about CERT NIC.LV (Latvia) based on TI listing  Changed information about CSIRT-MU (Czech Republic) based on TI listing  Changed information about CERT.AT (Austria) based on TI listing  Changed information about HR-CERT(Croatia) based on TI listing  Changed information about CERT.BE (Belgium) based on TI listing  Added team and text about Swedbank SIRT (Sweden) based on TI listing  Added team and text about IBM ERS (International) based on TI listing  Added team and text about SunCERT (International) based on TI listing  Changed information about CISCO PSIRT (International) based on TI listing

text:  Removed broken links  Added S21sec CERT (Spain) based on TI listing  Added CESICAT-CERT (Spain) based on TI listing  Added CERT-XMCO (France) based on TI listing  Added ESISS (UK) based on TI listing  Added CSIRT.SK (Slovakia) based on TI listing  Added GovCERT.dk (Denmark) based on TI listing  Added MD-CERT (Moldova) based on TI listing  Added Team Cymru based on TI listing  Updated name of CERT-DVT (formerly APOGEE SecWatch), TI-URL, URL based on TI listing  Updated name, constituency, TI Link and TI Status information of CZ.NIC-CSIRT (Czech Republic) based on TI listing  Updated TI Link and TI Status of CSIRTUK (UK) based on TI listing  Updated link to DDIRV (Latvia)  Added information about former name of CERT NIC.LV (Latvia)  Changed the name of LV CERT initiative to LV CSIRT and updated the link  Added Latvia, Lithuania to the other locations of TS-CERT (Sweden) based on TI listing  Updated TI Link for KIT-CERT (Germany) based on TI listing  Updated TI Status of CSIRT-MU (Czech Republic) based on TI listing  Updated TI Link of HR-CERT (Croatia) based on TI listing  Updated link to CSIRT.CZ (Czech Republic) based on TI listing  Updated TI Link, TI Status and FIRST membership information of Nokia NIRT (Finland)  Added link and constituency information to CERT-Société Générale (France) based on TI listing  Added link to Siemens-CERT (Germany) based on TI listing

text: ENISA – CERT Inventory

text:  Updated link to BP DSAC (UK)  Changed TI Status of Cisco PSIRT based on TI listing  Updated link to Jumper CSIRT (Ireland)  Corrected URL of IRIS-CERT (Spain) based on TI listing  Updated TI Link of CERT.be (Belgium) based on TI listing

text:  Updated the name of CERT-SE (formerly SITIC) (Sweden)  Updated information of CZIRT.CZ (Czech Republic)  Updated information on CERTs in Cyprus  Added description of TI status “Accredited and Certified”  Updated TI status of GOVCERT.NL (Netherlands) based on TI listing  Updated information of IRISS CERT (Ireland) based on TI listing  Added AZ-CERT (Azerbaijan) based on TI listing  Updated TI status of CERT-GE (Georgia) based on TI listing

text:  Updated name and information of CERT.LV (Latvia) (formerly CERT NIC.LV)  Deleted DDIRV (Latvia) due to its merger with CERT.LV  Updated status of AZ-CERT (Azerbaijan) based on TI listing  Updated information on CESICAT-CERT (Spain)  Added CORIS-STS (Romania) based on TI listing  Updated status of CERT-DVT (France) based on TI listing

text:  Updated information about CERT.LV (Latvia)  Updated information about CIRCL (Luxembourg)  Updated information about CERT-DEVOTEAM (France)  Updated TI link of CERT-SE (Sweden)  Updated information about CERT-MU (Czech Republic) based on TI listing  Updated TI status of CSIRT.SK (Slovakia) based on TI listing

text:  Updated information on CORIS-STS (Romania) based on TI listing  Updated information on CERT-LEXSI (France) based on TI listing  Updated information on CSIRT.SK (Slovakia) based on TI listing  Updated information on CERT-GE (Georgia) based on TI listing  Added AMRES-CSIRT (Serbia) based on TI listing  Added ETHZ-NSG (Switzerland) based on TI listing  Updated information on DAN-CERT (UK) based on TI listing  Updated information on CSIRT-MU (Czech Republic) based on TI listing  Updated information on SI-CERT (Slovenia) based on TI listing  Updated information on AZ-CERT (Azerbaijan) based on TI listing  Updated information on CIRCL (Luxembourg) based on TI listing  Updated information on ESISS (UK) based on TI listing  Updated information on SWITCH-CERT (Switzerland) based on TI listing  Updated information on S21sec CERT (Spain)  Updated information on CERT.PT (Portugal)  Updated information on CERT-UA (Ukraine)  Added csirtPT (Portugal) based on TI listing

text: ENISA – CERT Inventory

text:  Added MAPFRE-CCG-CERT (Spain) based on TI listing

text:  Added Cisco CSIRT (World Wide) based on TI listing  Updated information on EGE OSCT based on TI listing  Added CERT-EU (European Union) based on TI listing  Added CERT AM (CERT Armenia) based on TI listing  Updated information on CSIRT.CZ (Czech Republic)  Updated information on Danish GovCERT (Denmark)  Added CERT-GOV-GE (Georgia) based on TI listing  Added NCERT-GR (Greece) based on TI listing  Updated information on CIRCL(Luxembourg)  Updated information on CERT.GOV.PL (Poland)  Added DGS-IRT (Spain) based on TI listing  Added CERT-RO (Romania) based on TI listing  Updated information on CSIRTCV (Spain)  Updated information on S21sec CERT (Spain)  Added Handelsbanken SIRT (Sweden) based on TI listing  Updated information on CERT-SE (Sweden)  Updated information on Swedbank SIRT (Sweden)  Added WAR-CSIIRT (United Kingdom) based on TI listing  Updated information on DCSIRT (United Kingdom)  Updated information on ESISS (United Kingdom)

text:  Updated information on Cisco CSIRT (Worldwide)  Added team ICANN CIRC (Worldwide) based on TI listing  Updated information on R-IT CERT (Austria)  Updated information on CERT Bulgaria (Bulgaria)  Updated information on CARNet CERT (Croatia)  Updated information on CERT ZSIS (Croatia)  Updated information on HR-CERT (Croatia)  Added team ACTIVE24-CSIRT (Czech Republic) based on TI listing  Updated information on CESNET-CERTS (Czech Republic)  Updated information on CSIRT.CZ (Czech Republic)  Updated information on Danish GovCERT (Denmark)  Updated information on CERT-EE (Estonia)  Removed team SKY-CERT (Estonia) due to the lack of publicly available contact information  Removed team FSLabs (Finland) due to the lack of publicly available contact information  Updated information on Nokia NIRT (Finland)  Updated information on CERT-DVT (France)  Updated information on Cert-IST (France)  Updated information on CERT-LEXI (France)  Added team CERT LA POSTE (France) based on TI listing  Added team Orange-CERT-CC (France) based on TI listing  Updated information on CERT-GOV-GE (Georgia)  Updated information on CERT-GE (Georgia)  Updated information on CERT-BUND (Germany)  Updated information on CERT-VW (Germany)  Updated information on ComCERT (Germany)  Updated information on dCERT (Germany)  Updated information on FTS-CERT (Germany)  Updated information on GNS-CERT (Germany)  Updated information on PRE-CERT (Germany)

text: ENISA – CERT Inventory

text:  Updated information on SAP CERT (Germany)  Updated information on SECU-CERT (Germany)  Updated information on FORTH CERT (Greece)  Updated information on CERT-Hungary (Hungary)  Updated information on HEANET-CERT (Ireland)  Updated information on IRISS CERT (Ireland)  Updated information on Jumper CSIRT (Ireland)  Updated information on GOVCERT.IT (Italy)  Updated information on CERT.LV (Latvia)  Updated information on LITNET CERT (Lithuania)  Updated information on CIRCL (Luxembourg)  Updated information on CSRRT-LU (Luxembourg)  Updated information on RESTENA-CSIRT (Luxembourg)  Updated information on AAB GCIRT (Netherlands)  Updated information on CERT-RUG (Netherlands)  Removed GOVCERT.NL from the list due to the formation of NCSC-NL (Netherlands)  Updated information on KPN-CERT (Netherlands)  Added team NCSC-NL (Netherlands) based on TI listing  Updated information on RABOBANK SOC (Netherlands)  Updated information on SURFcert (Netherlands)  Added team NORDUnet CERT (Norway) based on TI listing  Updated information on DGS-IRT (Portugal)  Updated information on csirtPT (Portugal)  Updated information on CERT-RO (Romania)  Updated information on CORIS-STS (Romania)  Updated information on RoCSIRT (Romania)  Added team CERT-GIB (Russia) based on TI listing  Updated information on WebPlus ISP (Russia)  Updated information on CESICAT-CERT (Spain)  Updated information on S21sec CERT (Spain)  Updated information on Handelsbanken SIRT (Sweden)  Updated information on Swedbank SIRT (Sweden)  Updated information on TS-CERT (Sweden)  Updated information on CERN CERT (Switzerland)  Updated information on ETHZ-NSG (Switzerland)  Updated information on OS-CIRT (Switzerland)  Updated information on Ulak-CSIRT (Turkey)  Updated information on WAR-CSIIRT (United Kingdom)  Removed team BP DSAC (United Kingdom) from the list due to the lack of publicly available contact information  Updated information on DAN-CERT (United Kingdom)  Updated information on DCSIRT (United Kingdom)  Updated information on ESISS (United Kingdom)  Updated information on Q-CIRT (United Kingdom)  Removed team RM CSIRT (United Kingdom) from the list due to the lack of publicly available contact information

text:  Lay-out change: CERT teams are now displayed in tables  Moved team NORDUnet CERT from Norway to International (actual location is Denmark, though it is an international initiative)  Added team CERT.GOV.AZ (Azerbaijan) based on TI and FIRST listings  Updated information on CERT.BE (Belgium)  Removed team BELNET CERT (Belgium) due to its merge with CERT.BE  Updated information on CERT-GOV-GE (Georgia)  Updated information on Deutsche Telekom CERT (Germany)  Added team CERT BWi (Germany) based on FIRST listing  Added team gCERT (Germany) based on FIRST listing  Added team Vodafone-CERT (Germany) based on FIRST listing

text: ENISA – CERT Inventory

text:  Added team dbCERT (Germany) based on FIRST listing  Removed team GovCERT.IT (Italy)  Removed team GovCERT (Cyprus)  Added team LTU MOD CIRT (Lithuania) based on FIRST listing  Added team GOVCERT.LU (Luxembourg) based on TI listing  Added team DefCERT (The Netherlands) based on FIRST listing  Updated information on CERT-KUN (The Netherlands) due to its name change to CERT-RU  Added team DnB IRT (Norway) based on FIRST listing  Added team TELENOR (Norway) based on FIRST listing  Added team Statoil CSIRT (Norway) based on FIRST listing  Changed “Russia” to “Russian Federation”  Added team TBSecurity-CERT (Spain) based on FIRST listing  Added team Telefonica-CSIRT (Spain) based on FIRST listing  Added team LiU IRT (Sweden) based on TI listing  Added team GovCERT.ch (Switzerland) based on FIRST listing  Added team Bunker (United Kingdom) based on FIRST listing  Added team ISPIRIT (United Kingdom) based on FIRST listing  Added team NGRID-CSIRT (United Kingdom) based on FIRST listing  Added team P-CIRF (United Kingdom) based on FIRST listing  Added team CERTGOVIL (Israel) based on FIRST listing  Added team IUCC – InterUniversity Computation Center (Israel) based on FIRST listing

text:  Added team F-Secure Security Response  Updated information on LiU IRT based on TI listing  Updated information on TP CERT based on TI listing  Updated information on ILAN-CERT based on FIRST listing  Updated information on UPCCH Abusedesk based on TI listing  Updated information on AMC-CERT  Updated information on CERT-IDC  Updated information on CERT-UU  Updated information on UvA-CERT  Updated information on ETHZ-NSG  Updated information on CSIRTCV based on TI listing  Updated information on EGI CSIRT based on TI listing  Updated information on CERT-Société Générale based on FIRST listing  Updated information on CERT ZSIS based on TI listing  Updated information on CSIRT.CZ  Updated information on SWAT based on FIRST listing  Updated information on Orange-CERT-CC based on FIRST listing  Updated information on CERTBw based on FIRST listing  Updated information on dbCERT based on FIRST listing  Updated information on Cisco CSIRT based on TI listing  Updated information on NCIRC CC based on TI listing  Updated information on SunCERT based on TI listing  Updated information on ISPIRIT based on FIRST listing  Added team Commission CERT  Updated information on GovCERT based on TI listing  Updated information on CERT.GOV.AZ based on TI listing  Updated information on CERT ZSIS based on TI listing  Updated information on CERT-GE based on TI listing  Updated information on CERT-BUND based on TI listing

text: ENISA – CERT Inventory

text:  Updated information on CERTBw based on TI listing  Updated information on DFN-CERT based on TI listing  Updated information on FORTHcert based on TI listing  Updated information on CERT-IT based on TI listing  Updated information on CERT-LT based on TI listing  Updated information on IST-SVDPT based on TI listing  Updated information on CERT-IDC based on TI listing  Updated information on TP-CERT based on FIRST listing  Updated information on CSIRTCV based on TI listing  Updated information on MAPFRE-CCG-CERT based on TI listing  Added team Andalucia CERT  Updated information on GovCERT.CH based on TI listing  Updated information on RBSG-ISIRT based on TI listing

text:  Added team Belgacom CSIRT (Belgium) based on TI listing  Added team CSIRT-ECB based on TI listing  Added team COSDEF-CERT (Spain) based on TI listing  Added team UCL CERT (United Kingdom) based on TI listing  Added team CIRT.ME (Montenegro) based on TI listing  Added team WienCERT (Austria) based on TI listing  Added team ALCIRT (Albania) based on TI listing  Added team ISIRT (International) based on TI listing  Added team GSC Network Defence Capability (EU Institutions)  Added team GOVCERT.CZ (Czech Republic)  Updated information on BASF gCERT (Germany) based on FIRST Listing  Added team CIS-CERT (United Kingdom) based on FIRST Listing  Added team Shell SecOps (International) based on FIRST Listing  Updated information on CERT-EU (European Institutions)  Updated information on SVDPT-CERT (Lithuania)  Updated information on TR-CERT (Turkey)  Updated information on DKCERT (Denmark)

text:  Added team CERT RLP (Germany)  Added team CERT Poste Italiane (Italia)

text:  Updated team ISPIRIT (International) based on TI listing  Removed team Jumper CSIRT (Ireland)  Updated team KPMG-CSIRT (UK) based on TI listing  Updated team LTU MOD CERT (Lithuania) based on TI listing  Added team Malware.lu CERT (Luxemburg) based on TI listing  Updated team PI-CERT (Italy) based on TI listing  Added team Panasonic CSIRT (International) based on TI listing  Updated team Rabobank SOC (NL) based on TI listing  Added team SEZNAM.CZ-CSIRT (Czech Republic) based on TI listing  Updated team Secunia Research (Denmark) based on TI listing  Added team TK CERT (Germany) based on TI listing  Updated team TR-CERT (Turkey) based on TI listing  Updated team Telefonica CSIRT (Spain) based on TI listing  Updated team Vodafone-CERT (Germany) based on TI listing  Added team XING (Germany) based on TI listing

text: ENISA – CERT Inventory

text:  Updated team e-LC CSIRT (Spain) based on TI listing  Updated team mtCERT (Malta) based on TI listing  Added team information GSC-NDC-OC (Belgium) based on TI listing  Updated team information GOVCERT.CZ (Czech Republic) based on TI listing  Updated team information SEZNAM.CZ-CSIRT (Czech Republic) based on TI listing  Added team information CERT NRW (Germany) based on TI listing  Updated team information BASF gCERT (Germany) based on TI listing  Added team information CESCA-CSIRT (Spain) based on TI listing  Added team information CERT-SLC (France) based on TI listing  Updated team information CERTGOVIL (Israel) based on TI listing  Added team information FoxCERT (Netherlands ) based on TI listing  Updated team information AAB GCIRT (Netherlands ) based on TI listing  Updated team information DefCERT (Netherlands ) based on TI listing  Added team information CyberSOC-CERT (Spain)

text:  Added team information BF-SIRT (Sweden) based on TI listing  Added team information Incita Security CERT (Spain) based on TI listing  Added team information FMCERT (Swededn) based on TI listing  Added team information Healthnet (Luxemburg) based on TI listing  Added team information Casablanca.CZ CSIRT (Czech Republic) based on TI listing  Added team information Evonik CERT (Germany) based on TI listing  Added team information BVCERT (Switzerland) based on TI listing  Added team information CERT-XLM (Luxemburg) based on TI listing  Added team information IBD (The Netherlands) based on TI listing  Added team information CSIRT-VUT (Czech Republic) based on TI listing  Added team information CERT Credit Agricole (France) based on TI listing  Added team information 2S-CSIRT (Sweden) based on TI listing  Added team information CSC Az (Azerbaidjan) based on TI listing  Removed team information GNS-CERT (Germany) based on TI listing  Updated team CIRCL (Luxemburg) based on TI listing  Updated team RoCSIRT (Romania) based on TI listing  Updated team NCSC-FI (Finland) based on TI listing  Updated team S2OC based on team request  Added team information CERT Nazionale Italia (Italy) based on Official communication

text:  Added team NRD-CIRT (Lithuania) based on TI listing  Updated team CERT SLC (France) based on TI listing  Added team CDT-CERT (Czech Republic) based on TI listing  Added team Civil Society CERT (International) based on TI listing  Updated team CIS-CERT (United Kingdom) based on TI listing  Updated team GOVCERT.CZ (Czech Republic) based on TI listing  Updated team GOVCERT.CH (Switzerland) based on TI listing  Added team EDF-CIRC (Estonia) based on TI listing  Updated team CERT-RO @(Romania) based on TI listing  Added team 2CCSIRT (Czech Republic) based on TI listing  Added team Coolhousing CSIRT (Czech Republic) based on TI listing  Added team DBG-CERT (Luxemburg) based on TI listing  Updated team FoxCERT (The Netherlands) based on TI listing  Updated team EGI CSIRT (International) based on TI listing  Added team UTI CERT (Romania) based on TI listing  Added team CERT-BDF (France) based on TI listing  Added team RIPE NCC CSIRT (International) based on TI listing  Added team SEBET (Czech Republic) based on TI listing

text: ENISA – CERT Inventory

text:  Added team CSOB-Group-CSIRT (Czech Republic) based on TI listing  Updated team KMD IAC (Denmark) based on TI listing  Updated team LiU IRT (Sweden) based on TI listing  Added team CERT Orange Polska (Poland) based on TI listing  Added team CSIRT-BULL (France) based on TI listing  Updated team TR-CERT based on TI listing  Added team CERT Pubblica Ammiistrazione (Italy) based on official communication  Added team CSIRT Malta (Malta) based on official communication

text:  Added teams based on TI listing: o ALEF-CSIRT (Czech Republic) o ComCERT.PL (Poland) o UU-CSIRT (Sweden) o GEANT CERT (United Kingdom) o CERT SEKOIA (France) o AiG CERT (EU) o AlliaCERT (France) o ALEF-CSIRT (Czech Republic) o STI CERT (Romania) o BGA-CSIRT (Turkey) o CSIRT Merit (Czech Republic) o KAORA-CSIRT (Czech Republic) o SignalSEC Research (Turkey) o PXS-CSIRT (Belgium) o O2.cz CERT (Czech Republic) o CERTSI (Spain)  Added teams based on FIRST listing: o FinansCERT (Norway) o HelseCSIRT (Norway) o Swisscom CSIRT (Switzerland)  Removed or renamed: o SunCERT (International) o CERT ENEL (Italy) o DAN-CERT (United Kingdom) o CARNet CERT (Croatia) o CERT-IT (Italy) o TBSecurity-CERT (Spain) o Deutsche Telekom-CERT (Germany) o cert enel (Italy) o cert-it (Italy)  Other changes o CIRCA (National Austrian early warning system) merged into CERT.AT o Collaboration between GN2 JRA2 and TF-CSIRT (http://www.terena.nl/tech/task-forces/tf-csirt/gn2-jra2.html) from 2005, removed o LV CSIRT merged into CERT.LV o UKCERTs forum removed, does not exist. th o Added 10 ENISA Workshop (May 2015, Riga) o AIRT - Application for Incident Response Teams (http://www.airt.nl) no development since 2009, removed. o The RIPE IRT object (http://www.terena.nl/tech/task-forces/tf-csirt/irt.html) obsolete, removed.

text:  Added teams by request

text: o CSIS.DK (Denmark)

identifier: Inventory of CERT activities in Europe

nummer: inventory-of-cert-activities-in-europe

title: Inventory of CERT activities in Europe

text: ENISA – CERT Inventory

text: Inventory of CERT teams and activities in Europe

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Kaarel Jõgi

text: Contact

text: For contacting the authors please use cert-relations@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: This document makes use of public information provided by the global Forum for Incident Response and Security Teams (FIRST) and Trusted Introducer (TI, TF-CSIRT).

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: Executive Summary 6

text: 1. Terms and definitions 7

text: 2. Overview of countries covered 9

text: 3. Overview of CERTs by country and/or region 10

text: International CERT teams 10

text: European Institutions 11

text: Albania 11

text: Armenia 12

text: Austria 12

text: Azerbaijan 13

text: Belgium 13

text: Bulgaria 13

text: Croatia 13

text: Cyprus 14

text: Czech Republic 14

text: Denmark 15

text: Estonia 16

text: Finland 16

text: France 16

text: Georgia 18

text: Germany 18

text: Greecce 20

text: Hungary 20

text: Iceland 21

text: Ireland 21

text: Israel 21

text: Italy 22

text: Latvia 22

text: Lithuania 23

text: Luxembourg 23

text: Malta 24

text: Moldova 24

text: Montenegro 25

text: Netherlands (The) 25

text: Norway 26

text: Poland 26

text: Portugal 28

text: Romania 28

text: Russian Federation 29

text: Serbia 29

text: Slovakia 29

text: Slovenia 29

text: Spain 30

text: Sweden 31

text: Switzerland 31

text: Turkey 32

text: Ukraine 32

text: United Kingdom 33

text: 4. CERT co-operation activities and projects in Europe 35

text: CERT-Verbund (Germany) 35

text: Austrian Trust Circle 35

text: Dutch national cooperation (o-IRT-o) 35

text: EGC – European Government CERTs Group 36

text: NordUNET 36

text: TF-CSIRT - Task Force of Computer Security and Incident Response Teams 37

text: TF-CSIRT activities 37 4.6.1 37

text: TI - Trusted Introducer 38

text: 4.7.1 Short History 38

text: ENISA – Annual CERTs workshops 39

text: EU FI-ISAC 39

text: 5. CERT supporting activities and projects 40

text: CERT-in-a-box/Alerting-Service-in-a-box 40

text: CSIRT mentoring scheme 40

text: CSIRT Starter Kit 41

text: Handbook of legislative Procedures for CSIRTs 41

text: RTIR - Request Tracker for Incident Response WG 41

text: TRANSITS - Training of Network Security Incident Teams Staff 42

text: The WARP initiative - Warning, Advice and Reporting Points 42

text: 5.7.1 The WARP Toolbox 43

text: ENISA exercise material for CERTs 43

text: 6. CERT standardisation activities 44

text: CAIF - Common Advisory Interchange Format 44

text: DAF - Deutsches Advisory Format/German Advisory Scheme 44

text: EISPP - European Information Security Promotion Program 44

text: STIX - Structured Threat Information eXpression 45

text: TAXII - Trusted Automated eXchange of Indicator Information 45

text: IODEF - Incident Object Description and Exchange Format 45

text: VEDEF - Vulnerability and Exploit Description and Exchange Format SecDEF - Security Description and Exchange Format 46

text: ENISA baseline capabilities of national/governmental CERTs 46

text: 7. Updates 48

text: Annex A: Main international CERT initiatives outside of Europe 49

text: A.1 AP-CERT - Asia Pacific Computer Emergency Response Team 49

text: A.1.1 Membership 49

text: A.2 FIRST - Forum of Incident Response and Security Teams 49

text: A.2.1 Vision 49 A.2.2 Mission Statement 49 A.2.3 Organisation 50 A.2.4 History 50

text: 8. Annex B: Version History 52

text: Executive Summary

text: This document aims to provide an overview on the actual situation concerning CERT teams across Europe. It provides a list of incident response teams and similar facilities by country and sector (type of constituency) but also contains a catalogue of co-operation, support- and standardisation activities & initiatives related to the CERT community.

text: This document implements one of the deliverables as laid down in the ENISA Work Programme 2013 WS3, “an updated CERT Inventory document” which covers update of activities, initiatives and status of CERT teams in Europe.

text: The report at hand gives a profile of the situation concerning CERTs and their activities in Europe. It shows which facts ENISA has to take into account in the following years of its work in order not to “re-invent the wheel” but to really add value, for example by facilitating events like TRANSITS courses, to join EGC-, TF- CSIRT- and other meetings, to discuss with established and new CERT-people and many more things like this.

text: Since the first version of the document in 2005, it was constantly updated in order to reflect the latest changes/updates in the CERT landscape. To remain useful in the future, it has to be regularly updated: obsolete information will have to be deleted, information about new teams and activities will have to be validated and added. This document lives from your feedback! So please report mistakes, changes and new information: cert-relations@enisa.europa.eu .

text: 1. Terms and definitions

text: CERT - Computer Emergency Response Team - A “CERT” is an organisation that studies computer and network security in order to provide incident response services to victims of attacks, publish alerts concerning vulnerabilities and threats, and to offer other information to help improve computer and network security. (See also: CSIRT). Throughout this document, the well-established term CERT will be used.

text: N/G CERT teams – The informal definitions for “national CERT” and for “governmental CERT” do not uniquely reflect the status, role and responsibility of all the CERT teams ENISA tries to address. In the context of this document and ENISAs work in the area of baseline capabilities the term “national / governmental CERT” is introduced. Still vague, this term depicts the following kind of CERT:

text:  acting as official national point of contact for national / governmental CERTs in other Member States  bearing responsibilities for the protection of critical information infrastructure (CIIP) in its country

text: The term “national / governmental CERT” therefore subsumes all “flavours” of national CERTs, governmental CERTs, national points of contacts and others in the EU Member States.

text: CSIRT - Computer Security and Incident Response Team - Over time, the CERTs (see above) extended their services from being a mere reaction force to a more complete security service provider, including preventive services like alerting or advisories and security management services. Therefore, the term “CERT” was not considered to be sufficient. As a result, the new term “CSIRT” was established in the end of the 90-ies. At the moment, both terms (CERT and CSIRT) are used in a synonymous manner, with CSIRT being the more precise term. Throughout this document, the well-established term CERT will be used.

text: Abuse Team - An Abuse team is a response facility, usually operated by an ISP, who professionally handles "Internet-abuse" reports or complaints (e.g. spam, viruses, offensive mails, etc.), with a team of people, on a relatively large scale.

text: FIRST – Global Forum for Incident Response Teams

text: IETF - The Internet Engineering Task Force - The Internet Engineering Task Force is a large open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. It is open to any interested individual. See IETF website.

text: IODEF - Incident Object Description and Exchange Format. See IODEF.

text: TF-CSIRT - Task Force CSIRT. See TF-CSIRT - Task Force of Computer Security and Incident Response Teams p. 37.

text: TI - Trusted Introducer service. See TI - Trusted Introducer p. 38.

text: TI Status: Listed - The initial stage of the TI process is being "listed" in the public TI database. In fact this means that a CSIRT is "known" to the rest of the world and accepted as being a CSIRT.

text: TI Status: Accreditation Candidate - From the moment that the team has received an "Accreditation Candidate" acknowledgement from the TI, the CSIRT team is publicly considered "Accreditation Candidate". The one and only goal of "Accreditation Candidate" status is to move to "Accredited".

text: TI Status: Accredited - From the moment that the team has properly documented that it meets the "Accredited" criteria – by means of correctly filled out Appendices B and D - and has received an "Accredited" acknowledgement from the TI, the CSIRT team is publicly considered "Accredited".

text: TI Status: Accredited and Certified - Certification is the next step in the TI CSIRT maturity model. TI Certification is meant for those “Accredited” teams who have internal and/or external reasons to have their maturity level gauged in an independent way. See TI certification web-page for more information.

text: WARP - Warning, Advice and Reporting Points. See WARPs.

text: 2. Overview of countries covered

text: The purpose of the current document is to provide a general overview of the CERTs and of their activities. The main focus is on European CERTs, however other countries such as members of the European Free Trade Association and other neighbours are covered as well.

text: The main source of information for this document is Trusted-Introducer . Other sources like FIRST, TF- CSIRT are also taken into account even though their scope is much larger.

text: A bi-annual update for the inventory is done based on latest CERT team updates found on Trusted- Introducer website.

text: For more detailed information, we refer to the information published on ENISA web site.

text: A total of 42 countries were included in the scope of the CERT inventory:

text: 3. Overview of CERTs by country and/or region

text: This section presents an overview of the identified CERT teams on a per-country/region basis. For each CERT, the information provided consists in its name, date of establishment, memberships towards international organisations (i.e. Trusted Introducer and FIRST), type of constituency and, were relevant, additional details (e.g. additional description, website URL, etc.).

text: International CERT teams

text: This section includes an inventory of the international CERTs:

text: European Institutions

text: This section includes the details of the CERT for European Institutions:

text: Albania

text: This section includes the details of the CERTs for this country:

text: Armenia

text: This section includes the details of the CERTs for this country

text: Austria

text: Azerbaijan

text: Belgium

text: Bulgaria

text: Croatia

text: Cyprus

text: Czech Republic

text: Denmark

text: Estonia

text: Finland

text: France

text: Georgia

text: Germany

text: Greece

text: Hungary

text: Iceland

text: Ireland

text: Israel

text: Italy

text: Latvia

text: Lithuania

text: Luxembourg

text: Malta

text: Moldova

text: Montenegro

text: Netherlands (The)

text: Norway

text: Poland

text: Portugal

text: Romania

text: Russian Federation

text: Serbia

text: Slovakia

text: Slovenia

text: Spain

text: Sweden

text: Switzerland

text: Turkey

text: Ukraine

text: United Kingdom

text: 4. CERT co-operation activities and projects in Europe CERT-Verbund (Germany)

text: Target Audience: German CERTs More Info: http://www.cert-verbund.de The German national CERT-Verbund is an alliance of German security and emergency response teams. The CERT-Verbund provides the German teams with a framework for co-operation and information sharing. Besides this, all the single teams stay autonomous in their responsibility for their respective constituency. The CERT-Verbund has the following overall goals:  Protection of the national IT-networks  Immediate joint reaction to security incidents

text: The CERT-Verbund looks after the following projects:  DAF - Deutsches Advisory Format (German advisory format)  SIRIOS – System for Incident Response in Operational Security

text: Austrian Trust Circle

text: Austrian Circle of Trust is an initiative of the Austrian Federal Chancellery and CERT.at and consists of Security Information Exchanges in the various areas of strategic information infrastructure (CIIP). CERT.at offers in cooperation with GovCERT Austria and the Austrian Federal Chancellery a formal framework for practical information exchange and joint projects in the area of security. Objectives of the Austrian Trust Circles are  Support of self-help in the sectors in security  Operational contacts for CERT.at in information about and handling of security incidents in the organizations  Operational expert for the Federal Chancellery in a crisis  Act creating a trust to be able to share in an emergency  Networking and information sharing within and between sectors of strategic infrastructure

text: Dutch national cooperation (o-IRT-o)

text: Target Audience: Incident handlers in the Netherlands More info: http://www.cert.nl o-IRT-o stands for the Dutch name 'operationeel Incident Response Team overleg' (operational Incident Response Team meeting). This forum is initiated by GOVCERT.NL in 2002. At the moment 31 organizations are participating in o-IRT-o. o-IRT-o is a group of incident handlers from the public and private sector in the Netherlands. Participants from the private sector are handlers at ISP's, banks, multi-national or industrial companies. From the public

text: sector GOVCERT.NL is participating but also universities, employees from the national police force and the High-Tech Crime Centre.

text: GOVCERT.NL facilitates this forum to stimulate the exchange of knowledge about various security- and incident-related topics like incidents, security-threat trends and best practices. Also, we would like to stimulate that incident handlers in the Netherlands know each other and that they can co-operate together during serious incidents.

text: Participants of o-IRT-o have signed a non-disclosure agreement. This agreement is signed on behalf of the person, not on behalf of the organization where the participant works for.

text: EGC – European Government CERTs Group

text: Target Audience: European Government CERTs

text: More Info: http://www.egc-group.org

text: The European Government CERTs group (EGC) is an informal group of governmental CSIRTs that is developing effective co-operation on incident response matters between its members, building upon the similarity in constituencies and problem sets between governmental CSIRTs in Europe.

text: To achieve this goal, the ECG group members will:  Jointly develop measures to deal with large-scale or regional network security incidents  Facilitate information sharing and technology exchange relating to IT security incidents and malicious code threats and vulnerabilities  Identify areas of specialist knowledge and expertise that could be shared within the group  Identify areas of collaborative research and development on subjects of mutual interest  Encourage formation of government CERTs in European countries Communicate common views with other initiatives and organisations.

text: NordUNET

text: Target Audience: CERTs in northern Europe/Scandinavia

text: More Info: http://www.nordu.net

text: NORDUnet is an international collaboration between the Nordic national networks for research and education. It interconnects these networks and connects them to the worldwide network for research and education and to the general purpose Internet. The current physical connections are shown on the connectivity map.

text: NORDUnet provides its services by a combination of leased lines and Internet services provided by other international operators. In addition to the basic Internet service NORDUnet operates information services and provides USENET NetNews and Multicast connectivity to the Nordic national networks.

text: NORDUnet also coordinates the Nordic national networks' IPv6 activities including the 6NET project and the national networks' CERT (Computer Emergency Response Team) activities.

text: NORDUnet has only few permanent employees. Most of the work is contracted to appropriate organisations in the Nordic area. NORDUnet is the result of the NORDUNET programme (1986 to 1992) financed by the Nordic Council of Ministers.

text: TF-CSIRT - Task Force of Computer Security and Incident Response Teams

text: Target Audience: European and international CERTs

text: More Info: https://www.terena.org/activities/tf-csirt/

text: Computer security incidents require fast and effective responses from the organisations concerned. Computer Security Incident Response Teams (CSIRTs) are therefore responsible for receiving and reviewing incident reports, and responding to them as appropriate. TF-CSIRT is a task force that promotes collaboration and coordination between CSIRTs in Europe and neighbouring regions, whilst liaising with relevant organisations at the global level and in other regions.

text: Goals of the task force

text: TF-CSIRT provides a forum where members of the CSIRT community can exchange experiences and knowledge in a trusted environment in order to improve cooperation and coordination. It maintains a system for registering and accrediting CSIRTs, as well as certifying service standards.

text: The task force also develops and provides services for CSIRTs, promotes the use of common standards and procedures for handling security incidents, and coordinates joint initiatives where appropriate. This includes the training of CSIRT staff, and assisting in the establishment and development of new CSIRTs. The task force further liaises with FIRST, ENISA, other regional CSIRT organisations, as well as defence and law enforcement agencies.

text: Secretarial support for this task force is provided by GÉANT.

text: Restructuring the task force

text: The new structure has been approved. The main changes are as follows:

text:  Introduction of membership based on existing TI categories.  Introduction of an elected Chair.  Transition TI Review Board to TF-CSIRT Steering Committee with enhanced role.  TF-CSIRT to formally coordinate Trusted Introducer and TRANSITS services.  Consolidation of ad-hoc procedural documents into new Terms of Reference.

text: Until 2015, the geographical scope of TF-CSIRT and Trusted Introducer was limited to Europe, the Middle East and Mediterranean Africa. Moving forward, the focus of TF-CSIRT remains European, and all TF-CSIRT meetings will continue to be held within Europe. Following demand from the broader CSIRT community, the geographical scope has now been broadened and teams from all geographical regions are entitled to join.

text: 4.6.1 TF-CSIRT activities

text:  Organizing meetings for the task force  Overseeing the Trusted Introducer service  Organizing TRANSITS courses  Overseeing RTIR incident handling software development  Support dissemination of abuse contacts  Review privacy and data protection procedures and regulations

text: TI - Trusted Introducer

text: Target Audience: European CERTs

text: More Info: https://www.trusted-introducer.org/

text: Hackers, viruses, and other security incidents pose an ever growing threat to the smooth operation of the Internet, which has by now become the main artery of information in the world and a major economic factor. Professionally managed networks have therefore established teams known as CSIRTs to deal with security incidents. Historically such teams were known as CERTs (Computer Emergency Response Teams). Collaboration between these teams is crucial because in many cases incidents originate from outside the network that is being affected. Such collaboration needs to be based on sufficient trust between the teams; reliable CSIRTs together form a closely-knit community, which is sometimes referred to as a "Web of Trust".

text: Originally the "Web of Trust" was based on personal relations between staff members of the CSIRTs concerned. However, with the growth of the Internet, and hence of the number of CSIRTs, and with frequent staff changes this is no longer feasible. Also procedures whereby a team is introduced into the "Web of Trust" on the basis of a recommendation from a CSIRT that is already in that Web have turned out not to be scalable. The Trusted Introducer Service (TI) has been set up to address this problem.

text: The TI provides European CSIRTs (Computer Security Incident Response Teams) with a public repository that lists all known European CSIRTs and explains about the TI's accreditation service. This service is meant to do just that: facilitate trust by formally accrediting CSIRTs that are ready to take that step. For a CSIRT to proceed from the status of "listed" to the status of "accredited" they need to go through a formalized accreditation scheme. Once "accredited" they gain access to the restricted TI repository: there they find the details about their fellow accredited CSIRTs, and several value-added services like readily downloadable contact lists and PGP-Key rings, secure discussion forum, automatic RIPE Database IRTobject registration and more.

text: A crucial service that is part of the accredited status of CSIRTs is maintenance: in a four-monthly cycle the actuality of data is verified with the accredited CSIRTs to prevent these data from going out-of-date.

text: 4.7.1 Short History

text: Originally commissioned by TERENA, the process for the Trusted Introducer - often referred to as just "TI" was developed by Don Stikvoort and Klaus-Peter Kossakowski. Their work was reviewed by the community of European CSIRTs.

text: Currently, the Trusted Introducer Service is operated by PRESECURE Consulting GmbH, Germany, in cooperation with other well-known members of the community, under contract from the GEANT, which acts in this role on behalf of the TI Accredited and Certified teams that define and pay for the Trusted Introducer service and some of the TF-CSIRT activities.

text: The TF-CSIRT Steering Committee, which has taken the role of the previous TI Review Board, is coordinating the activities of the Task Force including the Trusted Introducer Service. It is comprised of the TF-CSIRT Chair, the TF-CSIRT Secretary (an ex-officio representative of GEANT) and four elected representatives.

text: ENISA – Annual CERTs workshops

text: Target Audience: National / Governmental CERTs from the EU Member States More Info: https://www.enisa.europa.eu/activities/cert Since 2005, and on an annual basis, ENISA organises workshops for National and Governmental CERT teams from the EU Member States. These workshops cover subjects ranging from the establishment of a CERT to deep technical topics such as botnet mitigation and massive cyber-attacks. As such, the following workshops took place in the past: st  1 workshop (December 2005, Brussels), on “Lessons learned and good practice”; nd  2 workshop (October 2006, Brussels), on “Setting –up and cooperation”; rd  3 workshop (September 2007, Porto), on “Mitigation of Massive Cyberattacks”; th  4 workshop (May 2008, Athens), on “The role of CERT teams in National incident response plans”; th  5 workshop (May 2010, Athens), on “CERTs in Europe”; th  6 workshop (October 2011, Prague), on “Addressing NIS aspects of cybercrime”; th  7 workshop, part I (June 2012, Valletta), providing a hands-on technical training for national/governmental CERT teams; th  7 workshop, part II (October 2012, The Hague), on “CERTs and LEA addressing botnets”. th  8 workshop, part I (May 2013, Bucharest), providing a hands-on technical training for national/governmental CERT teams;  8th workshop, part II (October 2013, The Hague), on “(automated) information sharing between CERTs and LEA”.AntiPhishing Working Group (APWG) th  9 Workshop, Part I (May 2014, Heraklion), on “CERTs and Industrial Control Systems” th  9 workshop, Part II (October 2014, The Hague) th  10 Workshop (May 2015, Riga)

text: EU FI-ISAC

text: Target Audience: European CERTs, Law enforcement authorities and banks. The EU FI-ISAC is a European cooperation initiative formed in 2008 by ENISA, CPNI.NL and stakeholders from Hungary, England and Switzerland. It aims at facilitating the sharing of information over incidents, threats and vulnerabilities between banks, law enforcement authorities and CERTs from different countries. This international collaboration is facilitated through the use of common definitions, protocols (i.e. Traffic Light Protocol) and of a Membership Guideline. Four workshops have been organised by ENISA around this initiative between 2008 and 2010. Since that time the initiative has grown in participation and continues to operate by having two physical meetings per year.

text: 5. CERT supporting activities and projects CERT-in-a-box/Alerting-Service-in-a-box

text: Focus: Setting up a CERT

text: Target Audience: CERTs in creation.

text: The project 'CERT-in-a-Box' and 'Alerting service-in-a-Box' is an initiative of GOVCERT.NL to preserve the lessons learned from setting up GOVCERT.NL and 'De Waarschuwingsdienst', the Dutch national Alerting service.

text: The project aim is to help others starting a CSIRT or Alerting Service by:

text:  Getting them up to speed faster;  Taking the benefits and not making the same mistakes.

text: The CSIRT/CERT model can help you to get your organisation moving in matters of security handling and prevention, setting up the necessary policies for security and safe working methods and creating a security-aware culture within your company or Government. Some quotes to bear in mind when starting the implementation phase:  'Security is not a product but it is a process' - by Bruce Schneier;  'Plan your dive and dive your plan' - PADI diving rule;  'A CSIRT team is like a fire-brigade! It's just sad we don't have those shiny fire engines' – HB.

text: CSIRT mentoring scheme

text: Focus: Help new CERTs making “first steps”

text: Target Audience: Newly founded European CERTs

text: More Info: http://www.terena.nl/tech/task-forces/tf-csirt/mentoring.html

text: Starting or developing a CSIRT can sometimes seem a daunting step. Although there is a considerable amount of published material available, for example from the CERT Co-ordination Centre’s (CERT/CC) new teams support group in America and TERENA's CSIRT Task Force (TF-CSIRT) in Europe, new teams may also find it helpful to be able to talk to someone from an existing CSIRT for either information or reassurance. Many CSIRTs have offered an informal mentoring service for some time: this website aims to provide a single source of information about mentoring for new teams, particularly in Europe and neighbouring countries.

text: There are already a large number of national and international CSIRTs in Europe, covering education, government and commercial sectors. Although their first priority is to protect and inform their own constituencies, many of them are also prepared to volunteer some of their staff's time to help others who are trying to establish or develop their own teams. This help might cover, for example, informal advice when planning or establishing a team or help with the Trusted Introducer or FIRST membership processes. Depending on the mentor team, help might be provided by e-mail or telephone or by face-to-face meetings.

text: CSIRT Starter Kit

text: Focus: Established CERTS help new CERTs with the “first steps”

text: Target Audiences: Newly set up CERTs; CERTs in setting up process

text: More Info: https://www.terena.org/activities/tf-csirt/starter-kit.html

text: Many organisations are interested in having their own team to handle computer security incidents, but don't know where to start. Nowadays the problem is not that there is not enough information, rather that there is too much. This page therefore gives pointers to the first things you should read, before moving on to more comprehensive sites such as that maintained by the CERT Co-ordination Centre (CERT-CC).

text: Handbook of legislative Procedures for CSIRTs

text: Focus: Helping CSIRTs to deal with cyber-crime law

text: Target audience: European CERTs

text: More Info: http://www.rand.org/pubs/technical_reports/TR337

text: In 2003 the European Commission commissioned RAND Europe to develop a Handbook that provided an easy to use guide matching technical descriptions of incidents to the legal framework of the country in question, and detailed procedures for working with law enforcement to respond to incidents. This handbook was tailored to the user requirements of Europe's Computer Security Incident Response Team (CSIRT) community. RAND Europe and Lawfort were invited to update this first version of the Handbook, to take into account the recent developments in the legal framework in the EU and more importantly, to extend its scope to cover the situation in the 10 new Member States which joined the European Union on 1st May 2004. The MODINIS work programme supports this activity under the heading of "favouring coordination between CSIRTs."

text: The project has developed a report that provides an easy-to-read overview of the legal procedures of computer and network misuse in EU Countries for Assisting Computer Security Incident Response Teams (CSIRTS). This handbook provides user-friendly access to up to date information on rules and regulations concerning computer misuse and the collection and reporting of computer evidence currently in force in all 25 EU countries, together with guidelines as to when and how law enforcement must be informed of incidents. The project team has also developed a CD-ROM and a dedicated open website where CSIRT teams and other interested parties can access to information about national legal approaches to cybercrime in Europe. For more information about the project, please contact Lorenzo Valeri (lvaleri@rand.org) and Neil Robinson (neilr@rand.org).

text: RTIR - Request Tracker for Incident Response WG

text: Focus: Extend “Request Tracker” program to fit the needs of CERT

text: Target Audiences: CERTs and other Incident Handling Capacities

text: More Info: http://www.terena.nl/tech/task-forces/tf-csirt/rtir.html

text: The Task Force will define a way to set requirements, investigate ideas, develop new modules and generally monitor the progress of the Request Tracker for Incident Response (RTIR) Incident Handling tool. This work will be carried out under a statement of work with Best Practical Solutions LLC or by Task Force participants themselves. The aim of the activity is to extend the current application, by making it more

text: stable and adding new functionality, thus making it more adaptable for the general use of new, as well as established CSIRTs.

text: TRANSITS - Training of Network Security Incident Teams Staff

text: Focus: Educate staff of new teams in CERT issues

text: Target Audiences: CERTs, primarily but not necessarily only newly build ones

text: More Info: http://www.terena.org/activities/transits

text: TRANSITS is a training programme targeting new and experienced CSIRT personnel, as well as individuals with a bona-fide interest in establishing a CSIRT. It originates from a European Commission funded project to promote the establishment of CSIRTs by addressing the shortage of skilled staff, which ran from July 2002 to September 2005.

text: The courses are run within Europe by TERENA on a cost recovery basis, with financial support from ENISA, FIRST and other organisations.

text: TRANSISTS currently offers two types of training courses:

text:  TRANSITS-I, aimed at new or potential CSIRT personnel wishing to gain a good grounding in the main aspects of working in an incident handling and response team;  TRANSITS-II (introduced in 2010), aimed at more experienced personnel working for established CSIRTs. This course provides an in-depth study of key areas in incident handling and response operations, training in how to improve communications with constituents, along with practical exercises.

text: CiSP - Cyber information Sharing Partnership

text: Focus: A joint UK industry government initiative which allows members to share information on threats and vulnerabilities in a secure online environment. It is aimed at a broad range of sectors and has relevant material for SMEs, larger companies and government.

text: Target Audience: National - industry/communities in the UK

text: More Info: www.cert.gov.uk/cisp

text: This model is leading the way for information within the cyber security community, and has helped to increase the cyber resilience of the UK as a whole. It encompasses a national, collaborative approach to cyber-security, and has groups which bring together sectors, themes and geographic locations. The WARPs programme now sits as part of CERT-UK. WARPs are actively encouraged to work as part of the CiSP platform, and engage with regional nodes.

text: WARPs (Warning, Advice and Reporting Points) are part of NISCC's information sharing strategy to protect the UK's Critical National Infrastructure from electronic attack. WARPs have been shown to be effective in improving information security by stimulating better communication of alerts and warnings, improving awareness and education, and encouraging incident reporting. Membership of a WARP can also reduce the costs of good Security.

text: WARP members agree to work together in a community and share information to reduce the risk of their information systems being compromised and therefore reduce the risk to their organisation. This sharing

text: community could be based on a business sector, geographic location, technology standards, risk grouping or whatever makes business sense.

text: WARPs can deliver more effective and lower cost security by providing to members:

text:  A trusted environment  Security information filtering  Access to expert advice  Early warning of threats  Strategic decision support  Improved awareness

text: WARPs are currently established in the following sectors: Local Government, SMEs, Voluntary, Home Users, Emergency Services, Managed Service Providers, but are suitable for all types of community.

text: 5.7.1 The WARP Toolbox

text: NISCC provides interested parties with a comprehensive Toolbox to help build new WARPs. The WARP Toolbox website supports the development and provision of three core WARP services, which, between them, deliver all the benefits listed above:

text:  Filtered Warning Service — where members receive only the security information relevant to their needs as determined by categories selected in an on-line tick-list. These categories cover Warnings & Advisories associated with Vulnerabilities & Fixes; Threats & Incidents and Good Practice.  Advice Brokering Service — where members can learn from other members' initiatives & experience at meetings or using a bulletin board messaging service restricted to WARP members only. Subjects can be anything which adds value to the members e.g. patch management; training; supplier/product evaluations, security awareness.  Trusted Sharing Service — where reports are anonymised so members can learn from each other’s attacks & incidents without fear of embarrassment or recrimination.

text: The Filtered Warnings Application (FWA) is a specially developed software suite that provides personal level filtering of advisories and other notifications for each WARP member, and other membership management services. It was written specifically for the WARP programme and is only available to Registered WARPs (see http://www.warp.gov.uk/WarpRegister.htm). It may be used by some CERTs in cooperation with WARPs, by arrangement. The FWA software will use an XML schema based on the VEDEF standard to encourage a standardised but flexible Advisory format for use by all WARPs, and CERTs etc.

text: ENISA exercise material for CERTs

text: This material intends to help CERTs to train to react to everyday- and special events. The material produced in 2008 and updated in 2012 contained 23 exercises in various scenarios, ranging from CERT internal activities to coordination activities during large scale cyber attacks against whole countries.

text: In 2013 the existing collection was complemented with new exercise scenarios containing essential material for success in the CERT community and in the field of information security. https://www.enisa.europa.eu/activities/cert/training/training-resources

text: 6. CERT standardisation activities CAIF - Common Advisory Interchange Format

text: Standardisation: Exchange Format for security advisories

text: More Info: http://cert.uni-stuttgart.de/projects/caif

text: CAIF is an XML-based format to store and exchange security announcements in a normalized way. It provides a basic but comprehensive set of elements that is designed to describe the main aspects of an issue related to security. The set of elements can easily be extended to reflect temporary, exotic or new requirements in a per-document manner. Besides addressing more than one problem within a single document the format allows to group information for more than one target group of readers as well as multi-lingual textual descriptions within one document. This can be used to selectively produce different renderings of an announcement for the intended target groups addressing one, a sub-set, or all problems multi- or mono-lingual in the languages provided.

text: DAF - Deutsches Advisory Format/German Advisory Scheme

text: Standardisation: Exchange Format for security advisories, deducted from EISPP

text: DAF is an initiative of the German CERT-Verbund and is a core component of an infrastructure for the generation and of security advisories by different teams. DAF is especially tailored for the needs of the German CERTs, which is developed and maintained by CERT-Bund, DFN-CERT, PRESECURE and Siemens- CERT.

text: The goals of the cooperation in the area of security advisories are:

text:  Improve the quality of advisories  Quality assurance  Development of a model for system description  Establishment of a common rating scheme  Release of resources for better analysis capabilities

text: DAF is derived from EISPP, a project co-funded by the European Community under the Fifth Framework Programme.

text: EISPP - European Information Security Promotion Program

text: The European Information Security Promotion Programme (EISPP) is a project co-funded by the European Community under the Fifth Framework Programme. The EISPP project aims to develop a European framework, not only to share security knowledge but also to define the content and ways of disseminating security information to SMEs. By providing European SMEs with the necessary IT security services they will be encouraged to develop their trust and usage of e-commerce leading to increased and better opportunities for new business. The EISPP is a pioneer in the European Commission's vision of forming a European network of expertise within the European Union.

text: The project started in June 2002 and ran until January 2004. It has been run by a consortium of private sector organisations, comprising CERTs, ISP/ASPs, and Security professional organisations. The Consortium members are Cert-IST, esCERT-UPC, SIEMENS-CERT, Callineb Consulting, I-NET, CLUSIT and InetSecur.

text: STIX - Structured Threat Information eXpression

text: Standardisation: Structured cyber threat information exchange format

text: More info: http://stix.mitre.org/

text: STIX is a collaborative community-driven effort to define and develop a standardized language to represent structured cyber threat information. The STIX Language intends to convey the full range of potential cyber threat information and strives to be fully expressive, flexible, extensible, automatable, and as human-readable as possible. All interested parties are welcome to participate in evolving STIX as part of its open, collaborative community. TAXII is the preferred transport mechanist for STIX encoded data.

text: TAXII - Trusted Automated eXchange of Indicator Information

text: Standardisation: Services for exchanging cyber threat information

text: More info: http://taxii.mitre.org/

text: TAXII defines a set of services and message exchanges that, when implemented, enable sharing of actionable cyber threat information across organization and product/service boundaries. TAXII, through its member specifications, defines concepts, protocols, and message exchanges to exchange cyber threat information for the detection, prevention, and mitigation of cyber threats. TAXII is not a specific information sharing initiative or application and does not attempt to define trust agreements, governance, or other non-technical aspects of cyber threat information sharing. Instead, TAXII empowers organizations to achieve improved situational awareness about emerging threats, enabling organizations to share the information they choose with the partners they choose.

text: TAXII is the preferred method of exchanging information represented using the Structured Threat Information Expression (STIX™) language, enabling organizations to share structured cyber threat information in a secure and automated manner.

text: IODEF - Incident Object Description and Exchange Format

text: Standardisation: Exchange format for incident related data.

text: More Info:  Pages of the IODEF Working group (dissolved in 2002): http://www.terena.nl/tech/task-forces/tfcsirt/iodef.html  Pages of the INCH Working group: http://www.ietf.org/html.charters/inch-charter.html

text: Security incidents are becoming more common and more serious, and handling these incidents by Computer Security Incident Response Teams (CSIRTs) is becoming of increasing (commercial) importance. Incidents usually involve multiple CSIRTs of multiple administrative domains, each with their own incident handling systems, formats and procedures. To properly resolve an incident the involved CSIRTs need to exchange data related to the incident. To minimize the time spent on each incident and to allow for further automation of the incident handling process and let incident handlers spend their time on incident

text: handling instead of pumping data around, it would be advantageous to have a standardized incident data format and standardized incident data exchange procedures.

text: A standardized extendable data format and standardized incident exchange procedures would also allow aggregation of incident data across multiple administrative domains thus creating the possibility to create automated regular statistics. These statistics are an important enabler for the CSIRT community to spot trends, predict upcoming large-scale attacks, and so on.

text: The purpose of the Incident Object Description and Exchange Format Working Group is to define a common data format and common exchange procedures for sharing information needed to handle an incident between different CSIRTs and to exchange incident related data between CSIRTs that allows both known and new types of incidents to be formatted and exchanged. The Incident Object Description and Exchange Format Working Group will coordinate its efforts with other (IETF) Working Groups.

text: In 2002 the IODEF Working group was dissolved and the results transferred to the INCH Working group of the IETF.

text: VEDEF - Vulnerability and Exploit Description and Exchange Format SecDEF - Security Description and Exchange Format

text: Standardisation: Exchange format for security information, vulnerabilities and exploits.

text: As part of its role on encouraging a 'culture of security' across central and local government, the private sector, and the general public, the Central Sponsor for Information Assurance (CSIA) is participating in initiatives to evolve structured data exchange standards, based upon XML, for UK and international use within Information Assurance (IA).

text: The overall Security Description and Exchange Format (SecDEF) is a federated effort to encourage the crystallisation of various XML based Description and Exchange Formats (DEF) to support Information Exchange Requirements (IER) related to Security Information where there is a need to cross Management Domains.

text: Of these initiatives, the one that has been running the longest, is the Vulnerability and Exploit DEF (VEDEF) http://www.terena.org/activities/tf-csirt/vedef.html , for which the CSIA-chaired Working Group of the European Task Force on Computer Security Incident Response Teams TF-CSIRT which grew out of earlier UK work by CSIA's colleagues in the National Infrastructure Security Coordination Centre NISCC has been the main focus. CSIA have also been working with other international parties to encourage the evolution of VEDEF, including partners in the USA and Japan.

text: ENISA baseline capabilities of national/governmental CERTs

text: The report cover recommendations and proposals for capabilities of so called national / governmental CERTs, thus teams who serve the government of a country to protect critical information infrastructure.

text: The first part called “Operational aspects” (2009) was derived from the answers to a survey ENISA carried out among all 120+ publicly listed CERTs in Europe. This part mainly aims at CERT managers and staff members, has an operational/technical nature and has been very well accepted by the CERT community.

text: The second part called “Policy recommendations” was drafted in 2010. ENISA made further improvements and presents a set of policy recommendations on baseline capabilities of national/governmental CERTs. The document takes into account recommendations by internationally recognised centres of expertise and draws upon the experience and effective practice of existing CERTs.

text: This second part aims mainly at supporting policy- and decision-makers in the EU member states in the establishment of a suitable framework that will enable their national / governmental CERTs to operate properly, by shedding a light on policy requirements and experiences in the member states and also by providing some background information on the operations of CERTs so that their requirements and needs are understood better.

text: In 2012, ENISA focused firstly on assessing the level of compliance with those defined baseline capabilities in the MS. Secondly, the capabilities has being discussed with CERTs and other concerned stakeholders. Where appropriate the capabilities are being adjusted or extended.

text: In 2013, ENISA assessed the level of compliance of ENISA baseline capabilities of n/g CERTs with other similar schemes and provided a report on harmonisation in areas like terminology, definitions, validation processes and requirements.

text: 7. Updates

text: To be really useful in the future, this document has to be updated: obsolete information will have to be deleted; information about new teams and activities will have to be validated and added. This document lives from your feedback, so please report mistakes, changes and new information by e-mail to certrelations@enisa.europa.eu .

text: Annex A: Main international CERT initiatives outside of Europe A.1 AP-CERT - Asia Pacific Computer Emergency Response Team

text: More Info: http://www.apcert.org

text: APCERT (Asia Pacific Computer Emergency Response Team) is a coalition of CSIRTs (Computer Security Incident Response Teams), from 13 economies across the Asia Pacific region. APCERT organizes an annual meeting called APSIRC conference, and the first conference was held in March 2002, Tokyo, Japan.

text: A.1.1 Membership

text: Any CSIRT from Asia Pacific Region, who is interested to furthering the objectives of APCERT, will be allowed to join as APCERT members after meeting all member accreditation requirements.

text: APCERT membership model has 2 levels:

text: Full members:

text: Full Members are CSIRTs/CERTs in the Asia Pacific region, who have the right to vote on APCERT issues, as well as to stand for election to the APCERT Steering Committee. All Founding Members are Full Members.

text: General Members:

text: Any CSIRTs/CERTs in the Asia Pacific region with an interest in incident response and IT security can join APCERT as a General Member. General Members are not eligible to vote nor to stand for election to the APCERT Steering Committee. An applicant is required to join APCERT as a General Member first. After applicants obtain a General Member status, they can later apply to upgrade their membership to a Full Member status. General Membership is a pre-requisite to become a Full Member.

text: Accreditation WG is working to develop the membership accreditation rule now. Membership application will be on the web soon.

text: A.2 FIRST - Forum of Incident Response and Security Teams

text: More Info: http://www.first.org

text: The Forum of Incident Response and Security Teams (FIRST) consists of a network of individual computer security incident response teams that work together voluntarily to deal with computer security problems and their prevention. These teams represent government, law enforcement, academia, the private sector, and other organisations with justifiable interest as determined by the Steering Committee.

text: A.2.1 Vision

text: FIRST is a premier organisation and recognized global leader in incident response. Membership in FIRST enables incident response teams to more effectively respond to security incidents by providing access to best practices, tools, and trusted communication with member teams.

text: A.2.2 Mission Statement

text:  FIRST is an international confederation of trusted computer incident response teams who cooperatively handle computer security incidents and promote incident prevention programs.  FIRST members develop and share technical information, tools, methodologies, processes and best practices

text:  FIRST encourages and promotes the development of quality security products, policies & services  FIRST develops and promulgates best computer security practices  FIRST promotes the creation and expansion of Incident Response teams and membership from organisations from around the world  FIRST members use their combined knowledge, skills and experience to promote a safer and more secure global electronic environment.

text: A.2.3 Organisation

text: Steering Committee

text: The Steering Committee is a group of individuals responsible for general operating policy, procedures, and related matters affecting the FIRST as a whole.

text: Board of Directors

text: The Board of Directors is a group of individuals responsible for general operating policy, procedures, and related matters affecting the First.Org, Inc., corporation as a whole.

text: Secretariat

text: The Secretariat serves as an administrative point for FIRST and provides a general contact for FIRST.

text: Member Teams

text: The incident response teams participating in FIRST represent organisations that assist an information technology community or other defined constituency in preventing and handling computer securityrelated incidents.

text: Liaisons

text: Individuals or representatives of organisations other than incident response or security teams that have a legitimate interest in and value to FIRST.

text: WG & Committees

text: FIRST Steering Committee establishes standing (permanent) and ad-hoc (temporary) committees in order to better achieve FIRST goals.

text: A.2.4 History

text: In November 1988, a computer security incident known as the "Internet worm" brought major portions of the Internet to its knees. Reaction to this incident was isolated and uncoordinated, resulting in much duplicated effort, and in conflicting solutions. Weeks later, the CERT Coordination Centre was formed. Soon after, the United States Department of Energy formed the Computer Incident Advisory Capability (CIAC) to serve its constituents.

text: Over the next two years, the number of incident response teams continued to grow, each with its own purpose, funding, reporting requirements, and constituency. The interaction between these teams experienced difficulties due to differences in language, time zone, and international standards or conventions. In October 1989, a major incident called the "Wank worm" highlighted the need for better communication and coordination between teams.

text: The FIRST was formed in 1990 in response to this problem. Since that time, it has continued to grow and evolve in response to the changing needs of the incident response and security teams and their constituencies.

text: By 2002, the Internet had grown from 60,000 host computer systems to 150 million in nearly all countries in the world (see Internet Domain Survey at the Internet Software Consortium). Many companies now rely on the Internet in their daily business transactions. Incident response and security teams continue to form around the globe, covering a range of constituencies from whole countries, to multi-national organisations. The FIRST membership consists of teams from a wide variety of organisations including educational, commercial, vendor, government and military.

text: 8. Annex B: Version History

text: v1.0: (12/2005) Initial release as ENISA deliverable for 2005

text: v1.1: (12/2005) First review; eliminated some errors (map updated to v1.1)

text: v1.2: (02/2006) Added/deleted some teams; design of the online version (map updated to v1.2)

text: v1.3: (10/2006) (map updated to v1.3):

text: v1.4: (12/2006) Inventory and map updated to v1.4:

text: v1.5: (09/2007) Inventory and map updated to v1.5:

text: v1.6: (05/2008) Inventory and map updated to v1.6:

text: v1.7: (10/2008) Inventory and map updated to v1.7:

text: v1.8: (05/2009) Inventory and map updated to v1.8:

text: v1.9: (11/2009) Inventory and map updated to v1.9:

text: V2.0: (06/2010) Inventory and map updated to v2.0:

text: V2.1: (11/2010) Inventory and map updated to v2.1:

text: V2.2: (1/2011) Inventory and map updated to v2.2:

text: V2.3 (2/2011) Inventory and map updated to v2.3:

text: V2.4 (3/2011) Inventory updated to v2.4:

text: V2.5 (6/2011) Inventory updated to v2.5:

text: V2.6 (11/2011) Inventory updated to v2.6:

text: V2.7 (06/2012) Inventory updated to v2.7:

text: V2.8 (08/2012) Inventory updated to v2.8:

text: V2.9 (11/2012) Inventory updated to v2.9:

text: V2.10 (06/2013) Inventory updated to v2.10:

text: V2.11 (06/2013) Inventory updated to v2.11:

text: V2.12 (12/2013) Inventory updated to v2.12:

text: V2.13 (06/2014) Inventory updated to v2.13:

text: V2.14 (12/2014) Inventory updated to v2.14:

text: V2.15 (07/2015) Inventory updated to v2.15:

text: V2.16 (09/2015) Inventory updated to v2.16:

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-79-00077-5 DOI: 10.2788/14231 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu