How an organization escalates incidents to a CSIRT is largely dependent on how it is structured. Organizations configure their individual CSIRT to best fit their structure and resources. The following three basic structures can serve as a guide for placing the CSIRT within the most suitable part of the organization to facilitate a speedy escalation, as well as to capture as many details of the incident as possible, in order for a proper investigation to take place.