CERT-RO

CERT-RO
Name	CERT-RO
Formation	1994
Headquarters	Bucharest
Region served	Romania
Parent organization	National Supervisory Authority for Personal Data Processing

CERT-RO

CERT-RO is the national computer emergency response team for Romania, established to coordinate responses to cybersecurity incidents, vulnerabilities, and national resilience activities. It operates from Bucharest and engages with a range of Romanian and international institutions to support incident handling, threat intelligence sharing, and public awareness. CERT-RO's work intersects with regulatory authorities, critical infrastructure operators, academic centers, and multinational bodies involved in cyber defense and information assurance.

History

CERT-RO traces roots to early initiatives following the rise of internet services in Romania during the 1990s, paralleling the formation of other national teams such as CERT/CC, US-CERT, JPCERT/CC, and CERT-EU. Its establishment in 1994 followed regional developments exemplified by institutions like RIPE NCC and ETSI that shaped internet governance in Europe. Throughout the 2000s CERT-RO expanded capabilities amid incidents involving actors associated with groups linked to events such as the 2007 cyberattacks on Estonia and operations reported in analyses by NATO Cooperative Cyber Defence Centre of Excellence. In the 2010s, CERT-RO increased engagement with entities like European Union Agency for Cybersecurity and national agencies including Romanian Intelligence Service and Inspectorate General of the Romanian Police to improve coordinated responses. Recent years saw CERT-RO adapt to threats noted in public reports by organizations like Microsoft, Kaspersky Lab, ESET, and FireEye (now Mandiant) as the threat landscape shifted toward ransomware and state-sponsored espionage highlighted in incidents such as the NotPetya and SolarWinds campaigns.

Organization and Governance

CERT-RO operates under the supervisory framework of the National Supervisory Authority for Personal Data Processing and collaborates with ministries including Ministry of Internal Affairs (Romania) and Ministry of National Defence (Romania). Its internal structure mirrors models used by teams such as US-CERT and CERT-EU, with divisions for incident response, vulnerability management, threat analysis, and public outreach. Governance involves liaison officers accredited to partner institutions like ANCOM and regulatory bodies comparable to ENISA at the EU level. Leadership appointments and operational mandates are informed by legislation and interagency protocols used in coordination with organizations such as NATO and the European Commission. CERT-RO maintains trained personnel familiar with frameworks from ISO/IEC 27001, incident taxonomy consonant with FIRST, and collaboration practices similar to FIRST member teams.

Responsibilities and Services

CERT-RO's responsibilities include national incident handling, vulnerability disclosure coordination, situational awareness, and cybersecurity advisories for operators such as banks like Banca Națională a României and energy companies following standards used by entities like ENTSO-E. Services offered include malware analysis, technical indicators sharing, CERT advisories, and coordination during cross-sector incidents akin to responses coordinated by CERT-EU during major compromises. It provides public guidance comparable to advisories published by NCSC (United Kingdom), operates computer security incident reporting channels analogous to US-CERT, and maintains a vulnerability handling policy influenced by Coordinated Vulnerability Disclosure practices seen in CISA. CERT-RO also supports capacity building through workshops and partnerships with universities such as University of Bucharest and research institutes like Institutul Național de Cercetare-Dezvoltare în Informatică.

Partnerships and National/International Cooperation

CERT-RO engages bilaterally and multilaterally with organizations including ENISA, NATO CCDCOE, European Commission, FIRST, and national teams like GovCERT.NL, ANSSI, BKA (Germany), CERT-FR, CERT-RODA (regional liaison), and CERT-EE. It cooperates with law enforcement bodies such as the European Cybercrime Centre at Europol and national prosecutors including offices linked to the High Court of Cassation and Justice (Romania). International cooperation extends to information exchanges with private-sector vendors like Microsoft, Cisco Systems, Google, Amazon Web Services, and cybersecurity firms such as Kaspersky Lab, ESET, CrowdStrike, and Mandiant. CERT-RO also participates in exercises and fora alongside members of NATO, the European Defence Agency, and civil society stakeholders including ISOC chapters and regional research centers.

Incidents and Notable Responses

CERT-RO has been active in responding to various incidents affecting Romanian public and private sectors, such as ransomware outbreaks and phishing campaigns reported in coordination with companies like Bitdefender and consultancies such as Deloitte and PwC. It has coordinated responses when national institutions faced compromises similar in pattern to cases documented by KrebsOnSecurity and advisory reports by CISA. CERT-RO has contributed to mitigation during cross-border incidents in collaboration with CERT-EU and ENISA and offered technical analyses comparable to those published after the WannaCry and NotPetya events. Public-facing advisories have addressed vulnerabilities disclosed by research teams from Google Project Zero and academic labs at institutions like Politehnica University of Bucharest.

Legal and Policy Framework

CERT-RO's mandate and authorities are shaped by Romanian legislation and EU directives such as the NIS Directive and its successor frameworks influenced by the European Union Agency for Cybersecurity (ENISA). Its operations intersect with national laws on data protection enforced by the National Supervisory Authority for Personal Data Processing and alignment with General Data Protection Regulation obligations. Cooperation with law enforcement follows protocols consistent with procedures used by Europol and national prosecutor offices, and its vulnerability disclosure and incident reporting practices reference standards from organizations like ISO/IEC JTC 1 and FIRST.

Category:Computer security organizations Category:Cybersecurity in Romania