The Referente CSIRT is the person or role responsible for coordinating CSIRT activities and incident management. In practice, this is the main point of contact that helps turn a security alert into an organized response: triage, escalation, documentation, communication, and closure.
This role matters because cyber incidents fail when no one has clear authority. During ransomware, phishing, or data-exfiltration events, the Referente CSIRT connects technical teams, management, legal, and compliance so decisions are made quickly and evidence is preserved. In a defense program, the role defines who can approve containment actions, who owns notifications, and how the incident timeline is tracked. In mature organizations, the Referente CSIRT is supported by runbooks, contact lists, and exercises so the response remains coordinated under pressure.