State of the Practice of Computer Security Incident Response Teams ...

their web pages. This may also be true for university or research networks. But for local and
commercial teams, that information is not usually available.
There is also no standard manager to which a CSIRT reports. The title of the manager often
relates to the department in which the CSIRT is located and the title that department’s manager
has been given, such as “Head of Network Services” or “Director of Telecommunications.”
Depending on who you talk to in the CSIRT community, you will get a variety of answers
to the question “To whom should a CSIRT report?” Some will say they should report to
the CIO, others to the CSO, and others to the head of audit or the compliance divisions.
To find out more information, we asked in our survey where CSIRTs were organizationally
located and to whom they reported. Participants in the CSIRT Organizational Survey cited the
IT department 41% of the time as their location in the hierarchical structure of their parent or
host organization. 58 The next most frequently cited location (24%) was for CSIRTs that are
separate groups outside of any existing department.
Looking at the survey data for the sector in which a CSIRT is located and its organizational
placement, the following trends can be observed: 59
• The majority of the military CSIRTs were located within the IT department.
• Almost all participating educational sector CSIRTs were located in the IT department of
the parent university or research network.
There were no other correlations based on sector.
3.2.3.1 To Whom the CSIRT Reports
The survey data also showed no clear or consistent reporting structure for CSIRTs.
• 38% of the participating CSIRTs stated that they report to someone other than the CIO,
IT manager, CSIRT manager, or security manager. Most of the teams identified an organizational
department or manager to whom the team reports.
• 31% stated that they report to the CIO.
• The only correlation between the sector and the reporting structure was in the banking
and finance sector, where all participating teams reported to the CIO. Across the other
sectors, the teams reported to various other managers.
58
59
In an informal survey of 14 CSIRTs done by the CERT CSIRT Development Team in 2000, the
majority of the teams also identified this location as the department in which the CSIRT was positioned.
See page 16 for a list of all sectors used in the survey.
52 CMU/SEI-2003-TR-001