What is a CERT in cybersecurity?
A CERT is a team that responds to cybersecurity incidents, not a certificate or a certification. What it does, the main types of CERT and how to call on one.
A CERT (Computer Emergency Response Team) is a specialist team that responds to cybersecurity incidents: it analyses an attack, helps contain it, works out how the attacker got in and supports the return to normal operations. A common mix-up is worth clearing up: in cybersecurity, a CERT is neither an SSL/TLS certificate nor a certification. It is a response team.
The CERT is the central player in incident response, introduced in our pillar article What is incident response in cybersecurity?.
Where the term comes from
The first CERT was set up in 1988 at Carnegie Mellon University’s Software Engineering Institute in the United States, following the Morris worm, one of the first large-scale attacks on the internet. The model then spread worldwide. You will also see CSIRT (Computer Security Incident Response Team), a more generic term adopted by the NIS2 Directive. In practice both describe the same job.
What is expected of such a team was set out long ago, notably in the IETF’s RFC 2350 (1998), which describes what a response team should publish: its constituency, services and contact details.
What a CERT does
| Mission | In practice |
|---|---|
| Incident response | Investigation, containment, eradication, recovery support |
| Technical analysis | Reviewing logs, endpoints and malware |
| Monitoring and alerts | Advisories on vulnerabilities and active campaigns |
| Coordination | Sharing information with other CERTs, authorities and vendors |
| Lessons learned | Incident report, recommendations to prevent a repeat |
A CERT does not monitor an organisation’s systems around the clock: that is the SOC’s job. The SOC detects; the CERT steps in once an incident is confirmed. See CERT, CSIRT and SOC: what are the differences?.
The main types of CERT
- National CERTs: under NIS2, every EU Member State must designate one or more CSIRTs (Article 10), which work together in the CSIRTs network (Article 15). In France, CERT-FR is run by ANSSI. It handles prevention, detection and incident response, mainly for government bodies and the most critical operators, and coordinates with other CERT networks.
- Sector and regional CERTs: dedicated to an industry (such as healthcare) or a region, they guide and assist local organisations.
- In-house CERTs: run by large groups to protect their own organisation.
- Provider CERTs: they respond on behalf of clients, often alongside a managed SOC.
CERTs also form communities. In France, InterCERT France brings together response teams to strengthen members’ ability to detect and handle incidents, and CERT-FR is a member.
When do you call a CERT?
As soon as an incident is confirmed or strongly suspected: ransomware, a compromised mailbox, unusual access to an admin account, a data leak. The sooner the call, the smaller the scope of the attack tends to be. To check what counts as an incident, see What is a cybersecurity incident?.
What the engagement covers depends on the contract: see What does incident response cover?. In France, ANSSI also qualifies incident response providers under its PRIS scheme. See PRIS: France’s qualified incident response providers.
Cyna’s CERT
At Cyna, the CERT works alongside the managed SOC teams. It is a member of InterCERT France and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. For an MSP, the benefit is not having to hunt for a responder during an attack: the CERT comes from the same partner as the SOC already monitoring the environment, and the MSP stays the client’s point of contact.
For examples of real interventions, see Lessons learned from cyberattacks handled by Cyna’s SOC and CERT in 2025 and What happens when a managed SOC detects an attack?.
Talk to an expert
Under attack? Report an incident: Cyna’s on-call team is available 24/7.
Want to know how a CERT could support you or your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.
Frequently asked questions
Will a national CERT step in for any business?
National CERTs mainly serve government bodies and the most critical operators. A small business that is attacked will usually be directed to a private provider. See Who to contact after a cyberattack.
What is the difference between a CERT and a CSIRT?
In practice, none: both describe an incident response team. CSIRT is the term used in EU legislation. See CERT, CSIRT and SOC: what are the differences?.
Do you need a contract before calling a CERT?
Practices vary between providers: some only respond for clients under contract, and arranging a contract in advance avoids negotiating in the middle of a crisis. Cyna's incident response on-call team is available 24/7 from the Report an incident page. See What is an incident response retainer?.
Do CERTs also work on prevention?
Yes. Many publish security advisories on vulnerabilities and share indicators of compromise with their peers.
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.