FIRST leads development of education curriculum for global Computer Security Incident Response Teams (CSIRTs)

FIRST is calling for community input on an updated CSIRT services list. Please review and provide comment at!

Calls for community input on "CSIRT services list" to inform the process

29 April 2015The Forum of Incident Response and Security Teams (FIRST) has announced its intention to develop an education programme for CSIRTs around the world with the help of the global security community. The development of the curriculum will be a collaborative effort convened by FIRST which starts today with the online publication of a draft "CSIRT Services Framework"; FIRST is asking for community input on this list of services a CSIRT is likely to provide and for which training may be required.

FIRST has already hosted two community summits, both in the US and in the UK, to gather feedback on curriculum needs and the services a CSIRT team may deliver to its constituency. These have involved CSIRT participants from national bodies and from educational communities of 15 countries across 6 continents. The services framework list being published today is the first result of their collaboration.

Maarten Van Horenbeeck, President of FIRST says, "Countries are increasingly recognising the importance of incident response teams in the fight against cyber-crime and the need for collaboration across borders. Our intention is to complement the excellent training that already exists for individuals with an education programme that helps enhance and develop team capability to improve performance and, critically, collaboration. We will develop this curriculum with the input of the incident response community to ensure it addresses real needs and adds value where it is needed the most."

"By publishing the "CSIRT services framework" for public comment, we hope to garner high-quality comments and insights from stakeholders around the world that will then act as the basis of a wide-ranging training curriculum."

The next step in the development of the training framework will be a third community summit at the 27th Annual FIRST Conference taking place this June in Berlin, where a broader cross-section of stakeholders including private sector will have the opportunity to provide input.

Members of the incident response community can get involved by sharing their views on the CSIRT services list published here


Janine Maxwell or Harry Saunders
Four Communications
Tel: +44 (0)20 3697 4351 or +44 (0)20 3697 4329
Email: or


Founded in 1990, FIRST consists of internet emergency response teams from more than 200 corporations, government bodies, universities and other institutions from the Americas, Asia, Europe, Africa and Oceania. It leads the world's fight-back against cyber-crime, sabotage and terrorism, and promotes cooperation among computer security incident response teams and law enforcement agencies. For more information, visit:

Please download the full release at first-press-release-20150429.pdf.