The terminology and variety of organizational structures involved in incident management today can often be confusing. We will begin to explore some of these areas of confusion in the material presented here. We will look at the difference and relationship between CSIRTs and incident management capabilities; we will also look at the difference and interrelationship between incident management and security management functions. The material in this report is based on the information we have collected through our own experiences, discussions with and observations of other CSIRTs and incident management organizations, research and review of existing publications and literature related to CSIRTs and incident response, and from experience with.
