Implementing Nicaragua’s National CSIRT: Impact, Team Formation, and Viability

Ransomware has emerged as one of the most significant and damaging cyber threats in recent years. Its evolution from its initial appearance to today's most advanced and sophisticated variants has transformed the cybersecurity landscape, affecting individuals, businesses, and organizations worldwide (Jaén et al. 2025). In the global context of growing cyber threats, the creation of a Government Cyber Incident Response Center (CSIRT) has become an essential component for strengthening response and recovery capabilities in the face of digital disasters. This research evaluates the viability of establishing a CSIRT in Nicaragua, with the goal of strengthening the Disaster Recovery Plan (DRP) within the National Cybersecurity Strategy. The research will adopt a methodological approach that will combine the analysis of cutting-edge international practices, to collect vitally important information we intend to deploy a Survey aimed at public officials from the different institutions of the Nicaraguan state that work in the IT department, through the interactive platform of SurveyMonkey: (https://es.surveymonkey.com/), as a case study strategy we are considering using the mixed methodology since this includes a descriptive and qualitative approach, as well as an exhaustive review of the state of the art in CSIRT, we will consider applying the guidelines of the PRISMA method (Preferred Reporting Items for Systematic Reviews and Meta-Analysis) to identify, select, evaluate and synthesize the reference studies (Ingrid 2024). This methodology will allow us to obtain a broader and deeper perspective of the phenomenon studied, achieving a greater understanding of the planning of material and financial resources, and the formation of the work team (Holgado et al., 2024). We will make a solid foundation that influences decision-making and implementation of the CSIRT project in the country of Nicaragua. Currently in Europe, new terms such as cyber reserve, cyber shields, recognition of cyber-attacks are being discussed, which can have devastating effects on civil life and the economy of a country. (Bes 2025), Cybersecurity requires considering the protection of three aspects: the protection of people, the protection of information security qualities, and the protection of physical assets and infrastructure present in cyberspace (Ramírez 2025).