> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/11.md). # Art. 11 — Requirements, technical capabilities and tasks of CSIRTs NIS2 Article 11 — Requirements, technical capabilities and tasks of CSIRTs. Directive (EU) 2022/2555, Chapter II — Coordinated cybersecurity regulatory frameworks. 1. The CSIRTs shall comply with the following requirements: 1. the CSIRTs shall ensure a high level of availability of their communication channels by avoiding single points of failure, and shall have several means for being contacted and for contacting others at all times; they shall clearly specify the communication channels and make them known to constituency and cooperative partners; 2. the CSIRTs’ premises and the supporting information systems shall be located at secure sites; 3. the CSIRTs shall be equipped with an appropriate system for managing and routing requests, in particular to facilitate effective and efficient handovers; 4. the CSIRTs shall ensure the confidentiality and trustworthiness of their operations; 5. the CSIRTs shall be adequately staffed to ensure availability of their services at all times and they shall ensure that their staff is trained appropriately; 6. the CSIRTs shall be equipped with redundant systems and backup working space to ensure continuity of their services. The CSIRTs may participate in international cooperation networks. 2. Member States shall ensure that their CSIRTs jointly have the technical capabilities necessary to carry out the tasks referred to in paragraph 3. Member States shall ensure that sufficient resources are allocated to their CSIRTs to ensure adequate staffing levels for the purpose of enabling the CSIRTs to develop their technical capabilities. 3. The CSIRTs shall have the following tasks: 1. monitoring and analysing cyber threats, vulnerabilities and incidents at national level and, upon request, providing assistance to essential and important entities concerned regarding real-time or near real-time monitoring of their network and information systems; 2. providing early warnings, alerts, announcements and dissemination of information to essential and important entities concerned as well as to the competent authorities and other relevant stakeholders on cyber threats, vulnerabilities and incidents, if possible in near real-time; 3. responding to incidents and providing assistance to the essential and important entities concerned, where applicable; 4. collecting and analysing forensic data and providing dynamic risk and [incident](https://headlesslaw.com/definitions/nis2/incident/) analysis and situational awareness regarding [cybersecurity](https://headlesslaw.com/definitions/nis2/cybersecurity/); 5. providing, upon the request of an essential or important [entity](https://headlesslaw.com/definitions/nis2/entity/), a proactive scanning of the network and information systems of the entity concerned to detect vulnerabilities with a potential significant impact; 6. participating in the CSIRTs network and providing mutual assistance in accordance with their capacities and competencies to other members of the CSIRTs network upon their request; 7. where applicable, acting as a coordinator for the purposes of the coordinated [vulnerability](https://headlesslaw.com/definitions/nis2/vulnerability/) disclosure under [Article 12(1)](/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/12.md); 8. contributing to the deployment of secure information-sharing tools pursuant to [Article 10(3)](/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/10.md). The CSIRTs may carry out proactive non-intrusive scanning of publicly accessible network and information systems of essential and important entities. Such scanning shall be carried out to detect vulnerable or insecurely configured network and information systems and inform the entities concerned. Such scanning shall not have any negative impact on the functioning of the entities’ services. When carrying out the tasks referred to in the first subparagraph, the CSIRTs may prioritise particular tasks on the basis of a risk-based approach. 4. The CSIRTs shall establish cooperation relationships with relevant stakeholders in the private sector, with a view to achieving the objectives of this Directive. 5. In order to facilitate cooperation referred to in paragraph 4, the CSIRTs shall promote the adoption and use of common or standardised practices, classification schemes and taxonomies in relation to: 1. incident-handling procedures; 2. crisis management; and 3. coordinated vulnerability disclosure under [Article 12(1)](/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/12.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/11.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.