Which organizations typically deal with computer security incidents?

• A. Law enforcement agencies only
• B. CERT, SERT, CSIRT, etc.
• C. Individual users
• D. Hardware vendors

Answer: (B)

Incident response is typically handled by dedicated computer security incident response teams such as CERTs and CSIRTs. These organizations are built to monitor, analyze, and coordinate responses to security incidents across sectors and borders. They provide timely advisories, guidance for containment and remediation, and help affected organizations recover. They also coordinate with law enforcement when criminal activity is involved, but their primary role is proactive incident handling and information sharing, not just investigations. While individual users can report issues and hardware vendors release patches, neither alone offers the centralized, collaborative incident response and coordination that CERT-like teams provide.