PSIRT Setup and Product Security Incident Response
We help manufacturers establish a Product Security Incident Response Team sized to their organization, or mature an existing one. The work defines charter, intake channel, triage and escalation playbooks and regulatory reporting, and tests them in a tabletop exercise, producing a response function that has been rehearsed before a real report arrives.
- Intake
- Receive reports through a defined disclosure channel.
- Triage
- Validate reports and assess their severity.
- Coordinate
- Align engineering, legal and communication on the fix.
- Report
- Disclose, notify customers and meet reporting timelines.
Scope
Charter, scope and staffing model
Disclosure policy and playbooks
Tabletop exercise and metrics
Starting information
Current handling of security reports, organization chart, product portfolio and applicable reporting obligations.
Applicable framework
The Cyber Resilience Act does not prescribe a PSIRT, but its reporting timelines apply from 11 September 2026 and need a staffed, rehearsed function. ISO/IEC 29147 and ISO/IEC 30111 describe vulnerability disclosure and handling processes.
Discuss your product
Tell us about the product, its current stage and the decision you need to make.
Discuss your product