Focusing on the practical aspects of CSIRT development, participants explored core functions and types of CSIRTs; learned to identify key organizational, technical and human components; and gained insights from real-life experiences of CSIRT implementation across the LAC region.

Most important take-aways from the seminar for successful building of CSIRT:

• A CSIRT should include both an incident response team and an incident management team. The effective operation of both is crucial to maintaining trust and ensuring a coordinated response.
• A thorough evaluation and proper preparation are essential for the effective operation of a CSIRT. It’s crucial to define why we need a CSIRT, what its mission will be, whom it will serve, and most importantly, who will support and fund it. Clear and sustainable funding is fundamental to ensuring its long-term success.
• It’s better to start by offering a few but effective services, and gradually expand over time. To achieve this, having a clear roadmap and a service catalog is essential.
• The CSIRT’s network infrastructure should be segregated from general organizational networks to prevent potential incidents from spreading and compromising other systems.
• Cybersecurity measures often sound good from a legal standpoint, but are not realistic from a technological perspective, thus the legal area should be aligned with the technological one.
• CSIRT personnel require not only strong technical skills but also interpersonal abilities: hiring should be based on an 80-20 balance, with 20% focused on technical capabilities and 80% on soft skills.
• Depending on the CSIRT’s mission and objectives, it should have different dimensions and structures tailored to its specific needs.
• The CSIRT must maintain clear communication and have an updated contact list and connections, fostering a trusted ecosystem to build a robust network that promotes cybersecurity.
• One of the main objectives of a CSIRT is to minimize false negatives and maximize true positives—ensuring that real threats are not missed, while ignoring noise that doesn’t pose any real risk.

LAC4 remains committed to supporting its members in building and strengthening capacity for their CSIRT development and operations. Seminar was attended by 132 stakeholders and policymakers from LAC4 Participant Nations. Seminar was designed for cybersecurity stakeholders and policymakers from LAC4 member countries of Antigua and Barbuda, Colombia, the Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Panama and Uruguay and members of RedCLARA.

Next LAC4 members-only seminar will take place in August 2025.