Due to the expansion of the digitalization business processes, organizations are now exposed to an increased risk of computer incidents. To effectively establish computer incident response capabilities, it is necessary to determine what types of incidents are most likely, considering the size and type of business of the organization does and current cybersecurity trends, and accordingly create one or more incident response teams. Incident response plans, policies, and procedures are an important part of creating a team because they ensure that incident response is conducted effectively and consistently. An incident response team is a group of individuals consisting of security analysts organized to develop, recommend, and coordinate immediate mitigation actions to contain, eradicate, and recover from computer incidents. They are established for the needs of organizations, governments, and international organizations. Computer incident management consists of four phases: preparation, detection and analysis, containment, eradication and recovery, and post-incident activities. In Republic of Croatia, computer incidents are managed by the National CERT and, in the case of incidents involving state bodies, the Information Systems Security Bureau.