What is the difference between a real and a virtual IRT? $($D$4,$ L$7\mathrm{.}2)$

Real IRTs meet in an incident response center, SOC or other facility; virtual ones meet in the cloud.

Virtual IRTs have permanently assigned members, who may or may not be called on as needed for any given incident; real IRTs are staffed from third$-$party service organizations.

Real IRTs are staffed by permanent employees or members of the organization, have designated work centers or locations and are trained and certified in incident response; virtual IRTs use volunteer or part$-$time talent, and their members may or may not be fully trained or certified.

There is no difference between a real and virtual IRT.