Digital First Responders – The Role of Computer Security Incident Response Teams (CSIRTS) in Developing Countries

This note intends to provide policy makers in developing countries with a clear understanding of the role and importance of Computer Security Incident Response Teams (CSIRTs) for enhancing cyber resilience. It is based on the data available at the time of writing, and reflects evolving international good practices, including experiences in a wide range of countries from different regions on the status of CSIRT deployment across regions and income groups and outlines practical recommendations on how to establish and operate national CSIRTs, including for costs and staffing.

This note was written by Ghislain de Salins, Senior Digital Development Specialist, and Robert Collett, consultant, from the World Bank Digital Development Global Practice, in partnership with Chris Gibson, Serge Droz, Olivier Caleff and Klee Aiken from the global Forum of Incident Response and Security Teams (FIRST). It was reviewed by Giacomo Assenza, Paul Seaden, and Anders Pedersen from the World Bank, as well as by Jean-Robert Hountomey (AfricaCERT) and Vilius Benetis (NRD). It builds on previous publications on incident response capacity building by ITU, OAS, ENISA, GFCE and FIRST (referenced in the last section of this document), among others. The development of this note was funded by the World Bank Cybersecurity Multi-Donor Trust Fund.