typically have these in place, this is not necessarily true for smaller entities, or companies that are new to developing technology solutions (e.g. car manufacturers or banks).  Secondly, we encourage states themselves to require all departments to establish vulnerability disclosure policies, with clear processes and safe havens for security researchers, as the United States has recently embarked upon.  Thirdly, states should ensure that the legal frameworks they have in place allow security researchers to find and report vulnerabilities without negative sanctions for their behavior.  Finally, we encourage states to each adopt and publish respective Vulnerabilities Equities Processes, detailing how they evaluate whether to retain or disclose information on a potential ICT vulnerability. Cybersecurity Tech Accord signatories believe these should: k) States should not conduct or knowingly support activity to harm the information systems of the authorized emergency response teams (sometimes known as computer emergency response teams or cybersecurity incident response teams) of another State. A State should not use authorized emergency response teams to engage in malicious international activity. - Presume disclosure as the starting point; - Mandate that all government-held vulnerabilities, irrespective of where or how they have been identified, go through an evaluation process leading to a decision to disclose or retain it; - Make public the criteria used in determining whether to disclose a vulnerability or not. In addition to assessing the relevance of the vulnerability to national security, these criteria should also consider threat and impact, impact on international partners, and commercial concerns; - Clearly consider the impact on the computing ecosystem if the vulnerability is released publicly and the costs associated with cleanup and mitigation; - Ensure any decision to retain a vulnerability is subject to a six-month review; - Ensure that any retained vulnerabilities are secure from theft (or loss). Asia Pacific Network Information Centre  APNIC ran a workshoplxxv at the IGF in 2017 where this norm was discussed. As pointed out in different submissions, Microsoft and GPD, it is important to establish collaboration mechanisms with industry and the technical community, in particular the CERT community via first.org. Australian Strategic Policy Institute, International Cyber Policy Centre  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with States’ efforts to refrain from harming recognised CERTs, examples of implementation include: Global Partners Digital - States establish and assign an authorised national CERT - Participation of authorised national CERTs in regional and international networks, like FIRST, APCERT, OIC-CERT, PacSON - Participation of authorised national CERTs in international cybersecurity exercises and challenges, like the ASEAN Cyber Incident Drill. - States ensure a separation of roles and responsibilities of the authorised national CERT from other arms of government - States make public statements and commitments to the legal and legitimate use of sovereign cyber capabilities, and its adherence to international law and the norms.  Incident response requires quick information sharing, which is dependent on strong relationships between the actors involved. A degree of independence and transparency between computer incident response teams (CERTs) and parts of government is important from a rights perspective, to ensure that a CERT carries out its work without impinging on freedom of expression or privacy.lxxvi  Best practice observation of this norm should consider both authorised and non-authorised emergency response teams as CERTs vary widely globally in their independence and relationship to government actors. @DFAT DFAT.GOV.AU