Product Security Incident Response Team (PSIRT)

A Product Security Incident Response Team (PSIRT) is the organisational unit within a manufacturer responsible for the end-to-end vulnerability lifecycle: receiving reports from external researchers and customers, triaging and validating vulnerabilities, coordinating with engineering teams to develop fixes, managing disclosure timelines, and publishing security advisories. The PSIRT is the operational heart of a manufacturer's CVD programme. It is distinct from a CSIRT (Computer Security Incident Response Team), which focuses on internal IT security incidents. FIRST publishes a PSIRT Services Framework that defines the full range of PSIRT capabilities and is widely used as a maturity model.

While the CRA does not use the term 'PSIRT', Articles 13(6) and 14 require manufacturers to have capabilities that are functionally equivalent:

• Intake — an accessible channel for vulnerability reports with a published response commitment.
• Triage — a process for validating reports and assessing severity within defined timeframes.
• Coordination — the ability to manage multi-party disclosure when vulnerabilities affect more than one vendor.
• Notification — the capacity to notify ENISA and relevant CSIRTs within 24 hours of an actively exploited vulnerability.
• Advisory publication — the ability to publish machine-readable security advisories (CSAF format recommended).

Manufacturers that cannot demonstrate these capabilities will fail CRA conformity assessment.

For small and medium manufacturers, a full dedicated PSIRT team may not be feasible. A minimal CRA-compliant PSIRT capability requires:

1. A named PSIRT contact — one or more individuals who are responsible for security reports and whose contact details are published.
2. Documented triage SLAs — written procedures defining who reviews incoming reports, within what timeframe, and how severity is assessed.
3. An escalation path — a clear route from the PSIRT to engineering leadership and legal, required for high-severity vulnerabilities with disclosure implications.
4. Advisory tooling — the ability to produce and publish CSAF-format advisories and to request CVE IDs.
5. A CSIRT liaison — a documented contact at the national CSIRT for the manufacturer's primary EU market.

FIRST's PSIRT Services Framework defines five maturity levels. Most CRA-obligated manufacturers starting their compliance journey are at Level 1 (ad hoc) or Level 2 (defined). Common gaps include:

• No SLA for report acknowledgement — researchers who receive no response within 5 days typically assume the report has been ignored.
• No separation between IT security and product security — vulnerabilities in a product's firmware require different expertise and disclosure processes than a corporate IT incident.
• No multi-party coordination experience — vulnerabilities in shared components (e.g. a CVE in an embedded Bluetooth stack) often affect multiple manufacturers; coordinating simultaneous disclosure requires specific skills.
• Undocumented processes — informal arrangements that work until key personnel leave the organisation.