- incident management process
- hiring and mentoring CSIRT staff
- developing CSIRT policies and procedures
- requirements for developing CSIRT services
- handling media issues
- building and managing the CSIRT infrastructure
- coordinating response
- handling major events
- working with law enforcement
- evaluating CSIRT operations
- incident management capability metrics