Building a PSIRT with the FIRST PSIRT Services Framework
Connected products need someone who takes care of their vulnerabilities after release. Many companies give this task to a product security incident response team (PSIRT). The Forum of Incident Response and Security Teams (FIRST) has published a framework that structures how a PSIRT is set up and how it works.
This article explains what a PSIRT does, how the FIRST framework organizes it, and how a PSIRT fits into corporate security and the regulatory requirements for manufacturers.
Contents
What is FIRST?
FIRST (Forum of Incident Response and Security Teams) is an international organization that has promoted cooperation in cybersecurity since 1990. It is a global network of computer security incident response teams (CSIRTs) and product security incident response teams (PSIRTs). FIRST develops good practices, standards, and training programs. Its goal is to improve incident response worldwide and to support information sharing between security experts.
What is a PSIRT?
A PSIRT is a specialized group within a company that takes care of the security of the company's own products. Its main tasks are:
- receiving and processing vulnerability reports,
- analyzing and assessing vulnerabilities,
- coordinating the development of fixes, and
- communicating with internal and external stakeholders.
Through this work, a PSIRT continuously improves the security of the company's products and makes sure the company responds to security incidents in a professional way.
What is the FIRST PSIRT Services Framework?
The FIRST PSIRT Services Framework is a guide to building and running a product security incident response team. It defines the core areas and functions an effective PSIRT should cover. These include stakeholder management, vulnerability discovery, analysis, remediation, and disclosure coordination. The framework gives companies a structured path to set up or improve their PSIRT and helps make sure no relevant part of vulnerability management is missed.
Benefits of a PSIRT
A PSIRT gives companies strategic and operational benefits:
- Better product security and lower risk
A dedicated PSIRT detects, analyzes, and fixes vulnerabilities quickly and systematically. This makes products more secure and reduces the damage and cost that delayed or uncoordinated responses can cause. - Customer trust and reputation
Professional and transparent vulnerability management shows that the company takes security seriously. This builds customer trust and protects its reputation in a market that pays increasing attention to security. - Regulatory compliance
A PSIRT helps you meet security standards and legal requirements such as the Cyber Resilience Act. As regulatory requirements grow, this can become a real competitive advantage.
How PSIRT and CSIRT work together
A product security incident response team (PSIRT) focuses on the security of the company's products. A computer security incident response team (CSIRT) is responsible for the security of the internal IT infrastructure.
Despite these different focuses, the two teams overlap. PSIRTs and CSIRTs regularly share information on new threats and vulnerabilities, because problems in products can affect the internal infrastructure and vice versa. When a security incident occurs, both teams often work closely together on a solution that covers both sides.
Cloud computing is an area where their responsibilities can overlap in particular. If a company offers cloud services, the PSIRT must ensure the security of these products, while the CSIRT is responsible for the security of the underlying infrastructure. In such cases, the two teams need close coordination and a clear division of tasks so that vulnerabilities are addressed completely and incident response works without gaps.
The PSIRT and the Cyber Resilience Act
The Cyber Resilience Act (CRA), a new law of the European Union, is closely linked to the work of PSIRTs. It aims to improve the cybersecurity of products with digital elements and to create uniform rules across the EU. The CRA requires manufacturers to consider security from the product design stage and to maintain it throughout the product lifecycle.
PSIRTs play a central role here. They implement and run the processes the CRA requires for discovering, reporting, and fixing vulnerabilities. The CRA also requires a fast response to discovered vulnerabilities and transparent communication, both core tasks of a PSIRT. Companies that already run a well-functioning PSIRT based on a framework such as the FIRST PSIRT Services Framework are therefore better prepared for the CRA. Setting up or strengthening a PSIRT is a practical step toward meeting these requirements and helps you design and operate CRA-compliant products.
The PSIRT and IEC 62443
The international IEC 62443 series is a central reference for cybersecurity in industrial automation and control systems. Its part IEC 62443-4-1 sets requirements for a secure product development lifecycle, and many of them match the tasks of a PSIRT. The standard requires, among other things, processes for detecting, assessing, and fixing vulnerabilities and for coordinated vulnerability disclosure. All of these are core PSIRT tasks.
A PSIRT built on the FIRST framework lets you implement many of the practices that IEC 62443-4-1 requires. Examples are security incident management, security analyses, and the delivery of security updates. A PSIRT also supports the continuous improvement of product security, which is another central concern of the standard.
Aligning a PSIRT with IEC 62443 can therefore raise product security and make conformity with this industrial standard easier. This matters most for manufacturers of industrial control systems and similar products, which face increasingly strict security requirements.
Setting up a PSIRT with the FIRST framework
The FIRST PSIRT Services Framework describes how to structure and implement an effective PSIRT. It defines the areas and functions a PSIRT should cover and helps companies build a team that fits their needs.
The framework has six service areas:
- Stakeholder ecosystem management
A PSIRT must involve various internal and external stakeholders, including development teams, management, customers, and security researchers. The framework recommends setting up clear communication channels and defining processes for working with these groups. - Vulnerability discovery
This area covers proactive and reactive methods for finding vulnerabilities. The PSIRT should set up processes for receiving external reports as well as for internal security reviews. - Vulnerability triage and analysis
Reported or discovered vulnerabilities must be assessed and prioritized. The framework suggests building a team of analysts who investigate vulnerabilities and estimate their potential impact. - Vulnerability remediation
Confirmed security issues need fixes. The PSIRT coordinates the work with development teams and follows the process until a patch is released. - Vulnerability disclosure
Managing communication about vulnerabilities is a critical area. The framework recommends a team that writes security advisories and coordinates publication with everyone involved. - Training and education
Continuous training is essential. The PSIRT should develop training programs for its own staff and for other stakeholders such as developers or support teams.
For each of these areas, the FIRST framework defines specific services and functions. How you implement them depends on the size of your company and your product portfolio.
A PSIRT typically includes these roles:
- Lead: coordinates all activities and represents the team externally
- Analysts: investigate vulnerabilities and develop remediation strategies
- Coordinators: manage communication with stakeholders
- Technical experts: contribute in-depth product and security knowledge
- Communication specialists: write advisories and other notifications
The framework thus gives you a structured way to build a complete and effective PSIRT. It covers all relevant parts of vulnerability management and still leaves room to adapt the team to your specific needs.
Outlook
PSIRTs are becoming more important. Products are getting more complex, cyber threats are increasing, and regulatory requirements are growing. For these reasons, a PSIRT is turning into a standard part of corporate security.
PSIRT processes are increasingly integrated into the entire product lifecycle, from development to maintenance. PSIRTs are likely to rely more on automation and AI-supported tools to find vulnerabilities earlier and fix them more efficiently. Cooperation between the PSIRTs of different companies and industries is also likely to grow, so they can respond together to security problems that affect many products.
Companies that invest early in a well-functioning PSIRT will be better prepared for these developments and can gain an advantage in a market that pays increasing attention to security.
