National CSIRT (computer security incident response team)

A national CSIRT (computer security incident response team) is the public team each Member State designates under the NIS2 Directive to receive incident notifications, issue warnings and assist affected entities. In France, CERT-FR, housed within ANSSI (Agence nationale de la sécurité des systèmes d'information, the French national cybersecurity agency), serves as the national CSIRT. The legal basis is Article 10 of Directive (EU) 2022/2555 (NIS2): each Member State designates or establishes one or more CSIRTs, which may sit inside a competent authority, and notifies their identity to the Commission without undue delay. Article 11 lists their tasks: threat monitoring, warnings, assistance to affected entities, proactive network scanning, coordinated vulnerability disclosure. Article 15 brings the national CSIRTs and CERT-EU together in a network for which ENISA (European Union Agency for Cybersecurity) provides the secretariat, with the Commission sitting as an observer; every two years the network assesses operational cooperation and adopts a report. Once a notification is in, the CSIRT acknowledges receipt, gives initial feedback on the Article 23 early warning and cross-checks against other reports, which tells the victim whether it is alone. It then pushes indicators of compromise back out to the rest of the market without naming the source. Rebuilding an Active Directory, talking to the crew holding the keys or running three weeks of onsite forensics is not its job. Its support is free and limited by its headcount. For the cyber underwriter, everything turns on the incident response costs section: an insured that has notified CERT-FR still needs its vendor, and the policy pays that vendor. Two lines of the wording deserve a read before the loss. First, the cooperation-with-authorities clause: hours spent by the vendor or breach counsel preparing exchanges with the CSIRT are covered or not depending on the drafting. Second, confidentiality, since whatever goes to the CSIRT then circulates through the network in anonymized form. One caveat: the French transposition of NIS2 has run late, and the exact recipient of notifications must be read in the law in force on the date of loss.