What is a CSIRT? The UK model explained
A CSIRT is a Computer Security Incident Response Team. The UK’s national CSIRT is GCHQ, with the National Cyber Security Centre carrying out the role. Under the Cyber Security and Resilience Bill (CSRB), regulated organisations must copy their incident notifications to it when they notify their regulator.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What CSIRT means
CSIRT stands for Computer Security Incident Response Team. It is a group that receives reports of security incidents, helps respond to them and shares information so others can protect themselves.
The term has two common uses:
- An internal CSIRT: a team inside an organisation that handles its own incidents.
- A national CSIRT: a body with a country-wide role, often defined in law.
When the Cyber Security and Resilience Bill (CSRB) says "the CSIRT", it means the second one.
Who the UK's CSIRT is
Regulation 5 of the NIS Regulations 2018 designates GCHQ as the UK's CSIRT for the relevant sectors and digital services. In practice, the National Cyber Security Centre (NCSC), which is part of GCHQ, carries out the role.
That is why the law says GCHQ while most guidance says NCSC. They are describing the same arrangement. The Information Commissioner's Office guide to NIS also explains that the NCSC has no regulatory role under NIS. Inspection and enforcement are for competent authorities.
| The CSIRT | Your regulator | |
|---|---|---|
| Who | GCHQ, through the NCSC | Depends on your category and sector |
| Main purpose | Monitoring, incident response and advice | Oversight and enforcement |
| Can it fine you? | No | Yes |
| Receives your notification? | Yes, a copy under the Bill | Yes |
What the Bill changes
You must copy the CSIRT. Regulated organisations must send a copy of each incident notification to the CSIRT at the same time as sending it to their regulator. Regulations 11(8), 11A(7) and 12A(7) say this for operators of essential services, data centres and digital service providers, and regulation 14E(7) says it for managed service providers. Missing this step falls in the standard penalty band, according to the penalty provisions in the print brought from the Commons.
The CSIRT gets clearer powers with that information. Depending on the circumstances, it may:
- Notify relevant authorities overseas if a significant impact is likely there.
- Give the organisation information to help deal with the incident or prevent another.
- Disclose information to other regulated persons, where needed to prevent similar incidents, within limits on confidential and commercially harmful information.
- Inform the public, or work with the regulator on doing so, after the required consultation.
How this differs from a SOC or a CERT
| Term | What it usually means |
|---|---|
| CSIRT | Team focused on responding to and coordinating incidents |
| CERT | Computer Emergency Response Team. Often used interchangeably with CSIRT |
| SOC | Security Operations Centre. Monitors systems and detects and triages threats, often 24/7 |
| IR retainer | A contract giving you access to outside specialists when something goes wrong |
These are not fixed legal terms outside the regulations, and organisations use them differently.
Do you need your own CSIRT?
The Bill does not require you to have something called a CSIRT. It does expect you to meet the reporting deadlines and manage risk. So you need the capability, however you organise it.
You should be able to answer these questions:
- Who is on call? Name technical, legal, communications and senior decision-makers, with deputies.
- Who decides whether an incident is reportable? Set out who has authority, including out of hours.
- How does the clock get recorded? Log when you first became aware of a reportable incident.
- Who sends the notification? Make sure both the regulator and the CSIRT receive it at the same time.
- How do outside partners fit in? If your SOC or MSP spots something first, decide how quickly they must tell you.
- When was this last tested? Run an exercise using the 24-hour notification runbook.
Smaller organisations often mix an internal lead with an external SOC and incident response retainer. That can work, as long as a named person still has authority to make the decisions.
Reporting to the NCSC if you are not regulated
Organisations that are not regulated can still report significant incidents to the NCSC for help, but the NCSC decides what support to give, and that is not the same as a regulatory duty. Other reporting may still apply, such as a personal data breach report to the Information Commissioner's Office.
The NCSC's Annual Review 2025 shows how it triages: it received 1,727 tips and treated 429 as incidents needing its support, of which 204 were nationally significant. See UK cyber attack statistics.
Sources
Frequently asked questions
Computer Security Incident Response Team.
Regulation 5 of the NIS Regulations 2018 designates GCHQ. The National Cyber Security Centre carries out the function.
Not usually. A SOC generally monitors and detects threats, while a CSIRT focuses on responding to and coordinating incidents. Organisations use the terms in different ways.
The Bill does not require a team with that name. If you are regulated, you do need to be able to detect, decide on and report incidents within the deadlines, whether you use internal staff, outside partners or both.