SOC / CIRT (Security Operations Center / Cyber Incident Response Team)

The first CERT was set up at Carnegie Mellon University in November 1988, days after the Morris worm had knocked out a sizable share of the internet of the time. The model spread: NIS2 (Article 10) now requires each member state to designate one or more national CSIRTs, and NIST SP 800-61 is the reference playbook for the response cycle, from preparation to lessons learned. Inside a company the two functions are distinct. The SOC (Security Operations Center) monitors continuously, often 24/7: it takes alerts from the SIEM and EDR, correlates them, triages them and decides on escalation. The CIRT (Cyber Incident Response Team), or CSIRT, takes over once an incident is confirmed: containment, forensics, remediation, recovery. Large groups often merge the two. Mid-market companies almost always outsource the SOC to an MSSP or an MDR provider, and that matters, because a SOC only sees the logs it is sent. So the application form asks who runs monitoring, whether it covers nights and weekends, and how fast a critical alert gets handled. The underwriter reads into the answers the likely time from intrusion to containment, which drives the size of a loss. Cyber policies on the market generally bundle access to an external incident response team, reachable through a hotline from first notice, for insureds without that capability in-house.