2.3. Sector CSIRTs
According to the Carnegie Mellon University SEI: CSIRT Sector Framework, ‘’Sector CSIRTs are responsible for facilitating incident response and management for a particular sector or subset of a country or economy (e.g. financial, energy, or government). Also referred to as sectoral CSIRTs, sector-based Cybersecurity Centers, Sector CERTs or Information Sharing and Analysis Centers (ISACs), they are uniquely adapted, specialised incident response teams […] that have the advantage of bridging the gap between public and private sectors, and providing a mechanism or platform for cooperation, information sharing, and trust building’’.
Case Study: Sector CSIRTs in Africa
Tunisia: The Financial CERT offers security services to the Tunisian financial sector. These services include monitoring, incident management, threat intelligence, and sensitisation. The Financial CERT is a member of FIRST.
Egypt: EG-FinCIRT was set up by the Central Bank of Egypt in line with the bank’s strategy to move towards a less-cash economy, support fintech applications and financial inclusion. According to the Central Bank of Egypt, Economic Review Vol. 60 No. 4 2019/2020, EG-FinCIRT provides incident response, proactive monitoring, and analysis of information security incidents to the financial sector with a significant human capital investment made to support these functions.
Ghana: The NCA-CERT was established by the National Communications Authority, the regulator for the communications industry, to respond to incidents within the communications Sector.
The primary constituency of NCA-CERT is licensed operators within the communications sector and their subscribers. It provides a platform for information sharing and coordinates incidents within the communications sector
The CERT works with its constituents to infuse cyber security best practices into its regulatory and licensing regimes, while providing services including Incident Management, Analysis, Information Assurance, Situational Awareness, Communications and Outreach, Capability Development, Research and Development.