ACTION ITEM 5 INCIDENT PREVENTION, RESPONSE AND REMEDIATION Computer Security Incident Response Team (CSIRT) —as defined by the NIS Directive— is responsible for actively support public and private operators in case of cyber attacks and disturbances. In the process of transposing the Directive, current public Computer Emergency Response Teams (National CERT and PA-CERT) will merge their tools and procedures in a coordinated cyber-incident management effort. 5.1 Integrated capacity a. Create a single point of contact and one or more CSIRT with full incident response capabilities (according to NIS Directive). b. Establish one or more NIS National Authorities. c. Fully implement legal framework for CSIRT/CERT, SOC, and technical intervention teams (see also AI 1.3d). d. Align capacities of current national cybersecurity actors (N-CERT, PA-CERT, DoDCERT, National Anti-Crime Computer Centre for the Protection of Critical Infrastructure, Intelligence) with NIS requirements. Identify cooperation mechanisms among them. e. Develop automated and standardized cyber incident management model —with a specific focus on triage phases. 21