This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| CSIRT Madrid | |
|---|---|
| Name | CSIRT Madrid |
| Formed | 2000s |
| Headquarters | Madrid |
| Jurisdiction | Community of Madrid |
| Parent agency | Community of Madrid |
CSIRT Madrid is a computer security incident response team serving the Community of Madrid and associated public administrations, critical infrastructure operators, and private-sector stakeholders. It functions within a networked European cyber incident response ecosystem alongside entities such as INCIBE, CERT-EU, ENISA, and national cybersecurity authorities. CSIRT Madrid provides technical coordination for cybersecurity incidents, vulnerability handling, and situational awareness while interfacing with regional institutions like the Assembly of Madrid and municipal providers.
CSIRT Madrid traces its origins to early regional initiatives for information security in the 2000s as Spain and the European Union increased focus on cyber resilience after high-profile incidents and directives. The team emerged amid institutional responses to threats exemplified by attacks contemporaneous with events involving Conficker, Stuxnet, and later campaigns linked to actors highlighted in reports by Europol. Over time CSIRT Madrid expanded in scope parallel to legislative milestones such as the NIS Directive and Spain’s national strategies, coordinating with national bodies like the Centro Criptológico Nacional and operational partners including INCIBE-CERT. The unit has adapted through waves of threats associated with ransomware families traced to groups referenced in advisories from US-CERT and multinational collaborations with agencies such as NATO cyber centres.
The organizational model aligns CSIRT Madrid with the administrative structure of the Community of Madrid and relevant autonomous community agencies. Governance involves statutory relationships with regional ministries and liaison roles to institutions such as the Presidency of the Community of Madrid, sectoral departments in Health Department of the Community of Madrid and Education Council of Madrid. Operational leadership typically coordinates with executive offices and legal services shaped by Spanish national law and EU frameworks like the GDPR and the NIS Directive. Staffing mixes technical analysts, incident handlers, and policy specialists drawn from pools near academic and research centres such as Universidad Complutense de Madrid and Universidad Politécnica de Madrid, and maintains technical exchanges with industry consortia including ISACA and OWASP chapters.
CSIRT Madrid’s portfolio includes proactive and reactive services: incident coordination, vulnerability disclosure management, threat intelligence dissemination, and support for continuity planning for entities such as hospitals in the Hospital La Paz network or transit operators in Metro de Madrid. It issues advisories referencing malware families and indicators of compromise documented by MISP Project instances and shares situational reports compatible with standards from STIX and TAXII. The team supports compliance activities connected to frameworks like ISO/IEC 27001 and assists stakeholders during regulatory processes involving authorities such as the Agencia Española de Protección de Datos. CSIRT Madrid publishes technical bulletins, organizes tabletop exercises with partners such as Red.es and private telecommunication firms like Telefónica, and provides incident triage for municipal information systems in coordination with city administrations like Ayuntamiento de Madrid.
Operational procedures follow established playbooks for containment, eradication, and recovery aligned with international best practices promoted by FIRST and CERT/CC. Incident response workflows incorporate digital forensics techniques employed by teams referencing methodologies from NIST publications and leverage tooling from open-source projects such as Volatility, TheHive Project, and Cortex. For large-scale events affecting critical services, CSIRT Madrid coordinates cross-sector responses with emergency planners from institutions like 112 Comunidad de Madrid and cybersecurity task forces that have engaged with incidents noted in reports by ENISA. The team maintains escalation pathways to national actors including INCIBE and international incident nodes like CERT-EU when transnational mitigation or intelligence sharing is required.
Partnerships span public, private, and academic sectors: cooperative arrangements exist with telecommunications operators (e.g., Orange Espagne), financial institutions represented in associations such as the Banco de España community, and research groups at centres like the Centro Nacional de Investigaciones Cardiovasculares for sector-specific resilience. CSIRT Madrid actively participates in European exercises and working groups associated with ENISA and regional CERT fora, and engages in bilateral collaborations with municipal teams from cities such as Barcelona and Valencia. It also contributes to industry-led initiatives including FIRST membership activities and shares intelligence feeds via platforms like MISP Project and collaborative channels used by Europol in cybercrime investigations.
Policy work addresses incident reporting protocols, responsible disclosure, and data protection obligations shaped by the GDPR and national cybersecurity law. CSIRT Madrid develops guidance aligning with standards such as ISO/IEC 27001 and ISO/IEC 27035 for incident management, and maps internal procedures to compliance expectations articulated by the European Commission and Spanish ministries. It publishes templates, playbooks, and classification criteria that reference taxonomy efforts from ENISA and operational guidance from CERT/CC to ensure interoperability with external CSIRTs and law enforcement partners like Cuerpo Nacional de Policía.
Public-facing activities include awareness campaigns, workshops, and training for administrations and citizens, often coordinated with educational institutions such as Universidad Carlos III de Madrid and non-profit organisations like Red.es-backed initiatives. CSIRT Madrid runs simulation exercises, cybersecurity conferences featuring speakers from entities like INCIBE and ENISA, and offers capacity-building for municipal IT staff, healthcare IT teams in hospitals like Hospital Gregorio Marañón, and small enterprises interacting with chambers such as the Cámara de Comercio de Madrid. These programs draw on curricula and certification pathways offered by bodies including ISC2 and ISACA.
Category:Computer security incident response teams Category:Organisations based in Madrid