In this guide for system and network administrators and managers, Lucas, director of security operations for a financial services company, and Moeller, a senior security engineer at a university, provide a set of steps for forming and managing a Computer Incident Response Team (CIRT). They explain how to establish a CIRT's focus and scope and offer organizational and workflow strategies for maximizing technical resources.