SIRT org model
Dedicated
A single SIRT team supports the entire organization. PSIRT, CSIRT, and TA-SIRT operate together as one centralized group.
Best suited for small and medium-sized organizations where security resources are concentrated in one team.
Distributed
Each business unit, department, or operational area maintains its own PSIRT and CSIRT capability. TA-SIRT provides expertise, research, guidance, and coordination across the organization.
Best suited for large enterprises with multiple independent teams.
Logical
PSIRT and CSIRT functions are formed from people across different departments. Team members may belong to separate organizations but operate together under a common SIRT framework and process.
Best suited for matrix organizations where resources are shared.
One-to-Many
A central SIRT team provides standards, governance, escalation support, guidance, and expertise. Individual departments maintain their own operational security personnel and execute locally.
Best suited for very large organizations where centralized governance is combined with decentralized execution.
SIRT org:
| Function | AMI State |
| PSIRT | AmiVul |
| CSIRT | AmiUA |
| Incident Recovery / DFIR | AmiComp |