CERT, CSIRT and SOC: what are the differences?

CERT and CSIRT mean, in practice, the same thing: a cybersecurity incident response team that steps in once an attack is confirmed. A SOC, by contrast, monitors systems continuously to detect attacks as early as possible. The SOC detects and triages; the CERT or CSIRT investigates and leads the response. The two functions complement each other.

These ideas sit at the heart of incident response, introduced in What is incident response in cybersecurity?.

CERT and CSIRT: two names, one job

CERT stands for Computer Emergency Response Team. It is the historical term, dating from the first such centre, set up in 1988 at Carnegie Mellon University. CSIRT stands for Computer Security Incident Response Team, a more generic term used in EU legislation: NIS2 requires each Member State to designate one or more CSIRTs (Article 10), sets out their requirements and tasks (Article 11) and brings them together in a European network (Article 15).

In France, CERT-FR, run by ANSSI, is the national team. Internationally, many teams belong to FIRST (the Forum of Incident Response and Security Teams), which welcomes CERTs and CSIRTs alike. Companies and providers use either name freely. For more, see What is a CERT in cybersecurity?.

The SOC: monitor and detect

A SOC (Security Operations Center) is a security monitoring centre. It collects logs and alerts from endpoints, servers, cloud services and network devices, correlates them and analyses them to spot an attack. Its work is continuous, ideally 24/7, because attackers do not keep office hours. See What is a SOC (Security Operations Center)?.

Side by side

	SOC	CERT / CSIRT
Main mission	Monitor, detect, triage	Respond, investigate, remediate
Rhythm	Continuous	Per incident (plus ongoing threat watch)
Trigger	Security events and alerts	Confirmed or strongly suspected incident
Typical actions	Alert analysis, device isolation, escalation	Investigation, persistence hunting, eradication, reporting
Outputs	Triaged alerts, monthly reports	Incident report, recommendations
Profiles	Tier 1 to 3 analysts	Incident responders, digital forensics specialists

For roles within a SOC, see Roles in a SOC team.

How they work together

In a real attack, the handover follows a few steps:

1. The SOC detects abnormal behaviour: a suspicious sign-in, mass file encryption, an attack tool running.
2. The SOC triages the alert and applies the agreed first containment steps (isolating a device through the EDR, for example).
3. The SOC escalates to the MSP and, if the incident is confirmed, to the CERT.
4. The CERT takes over: investigation, real scope of the attack, eradication, recovery support.
5. The SOC steps up monitoring during and after the incident, using indicators identified by the CERT.

The faster that handover, the earlier the attack is contained. That is why the boundary between the two teams must be clear before any incident, in the escalation procedure. See What happens when a managed SOC detects an attack?.

And the MSP?

For businesses supported by an MSP, there is a third player. The SOC and CERT analyse and advise; the MSP acts on the infrastructure it manages: account resets, restoration, server rebuilds. It also remains the client’s point of contact. See Managed SOC and MSP: who does what?.

The Cyna model

At Cyna, the managed SOC is run 24/7 from France by in-house teams and works with Cyna’s CERT, a member of InterCERT France. The CERT works with the SOC teams and can be mobilised quickly, and the incident response on-call team is available 24/7 from the Report an incident page. The terms of the SOC service (scope, licences) are set out in the contract agreed with the partner MSP. The MSP thus has a single partner for detection and response, and holds the relationship with its client.

Talk to an expert

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Want to clarify who does what between the SOC, the CERT and the MSP for your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Can a SOC do incident response?

It handles the first steps: triaging the alert, isolating a device, locking an account. In-depth investigation and hunting for persistence are the CERT's job.

Do you need separate providers for the SOC and the CERT?

No, and having both in one place is often simpler because the handover is smoother. At Cyna, the managed SOC and the CERT work together, and the incident response on-call team is available 24/7 from the Report an incident page.

Where does a NOC fit in?

A NOC monitors network availability and performance, not security. See SOC vs NOC.

Does a small business need both a SOC and a CERT?

It needs both functions, but not necessarily in-house. A managed SOC backed by a CERT, offered through its MSP, can cover both depending on the contract. See SOC for MSP.