...
eduGAIN CSIRT will support the eduGAIN participants investigating whether indeed an incident occurred and in case, determining the extent of the incident. This ranges from a single entity registered in one or more federations, to multiple entities from different federations affected.
Incident Response Coordination
eduGAIN's participants are Research and Education Federations, in which different organizations operate SPs and IdPs. Usually the mandate and scope of the SPs and IdPs security teams are limited to the home organization. The same holds for the federations participating in eduGAIN. eduGAN-CSIRT will organize the security incident communications across affected participants and coordinate the response activities to allow for an efficient containment and subsequently resolution of security incidents.
...
The incident resolution is ultimately the task of the organizations responsible for the end entities in eduGAIN (Service providers (SP), Identity Providers (IdP))SPs and IdPs). If possible, eduGAIN CSIRT will support the end entities with in coordination with the Federations Federations on request.
Proactive Activities
...