This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages) This article may be confusing or unclear to readers. Please help clarify the article. There might be a discussion about this on the talk page. (July 2009) (Learn how and when to remove this message) This article may contain original research. Please improve it by verifying the claims made and adding inline citations. Statements consisting only of original research should be removed. (July 2009) (Learn how and when to remove this message) This article relies on a single source. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "GFIRST" – news · newspapers · books · scholar · JSTOR (April 2025) (Learn how and when to remove this message) (Learn how and when to remove this message)

GFIRST is the United States Government Forum of Incident Response and Security Teams.^[1]

GFIRST was formed because there was a need and desire to improve information sharing about cybersecurity incidents across federal government incident response teams. The focus was to create an environment in which the technical owners and operators could share there experiences with each other in a trusted environment.

GFIRST evolved from a couple of earlier initiatives. Initially, there was a Task 1 initiative with the White House that focused on information sharing among a small group of incident response teams. The initial group was VA, IRS, DOE, and DOD. This group was successful in its initial information sharing efforts and the idea of G-CIRC was formed by the initial founders of the group (Rob Pate created the concept and eventually helped to launch GFIRST during the formation stage of DHS US-CERT).

The GFIRST community grew like wildfire and the number of participants in the monthly DHS hosted meetings grew. The GFIRST community had the opportunity to make site visits to other incident response team around the nation to learn the best practices from others across government. In addition, the Annual GFIRT conference became a yearly gathering for the incident response community as well as many security leaders inside and outside of government. GFIRST always strived to keep the content rich, the community strong and focused, as well as deliver value to the security community.

It was formed by a group of FIRST federal members (formed out of FEDCIRC) in 2003. GFIRST, hosted by US-CERT, is a community of more than 50+ incident response teams from various federal agencies working together to secure the federal government.

US-CERT hosts an annual GFIRST conference which is open to all interested in learning more about cyber security and incident response. GFIRST Conferences are a great place for public and private sector leaders serving in non-technical roles to become familiar with the fundamentals of cyber security and incident response. GFIRST is also an excellent resource for practitioners in incident response and information security from the public and private sectors.

• GFIRST Conference Site Archived 2009-07-07 at the Wayback Machine
• Original White House memorandum establishing FEDCIRC in 2002
• GFirst 2013 Website