ANNEXES Disclosure Policy OBJECTIVE Define how and what information can be disclosed to whom and under what circumstances, including stakeholders, partner CSIRTs, other government bodies, or even other members of CSIRT-XX. The way information is shared will be done according to its level of classification. SCOPE All information held or generated by CSIRT-XX. STATEMENT OF POLICY INTERNAL DISCLOSURE Within the CSIRT-XX team there shall be no limitations on information disclosure and sharing, unless made at the express request of the Director in regards to a specific action. As part of daily operational requirements, the CSIRT-XX will disclose certain information to the members of the organization. Any disclosure should take into account established procedures according to classification of information in question; disclosure of sensitive information must be authorized by the Director of CSIRT-XX or his or her designee. LEGAL ASPECTS CSIRT-XX will comply with all national legislation or organizational policy in responding to all third party requests for information. Such requests for information should be made through CSIRT-XX’s legal department of advisor. ORDERING INFORMATION Incident Response Groups Public Information Disclosure of public information is authorized, though it must be disseminated through channels established and managed by the communications or public affairs unit of CSIRT-XX, and done in accordance with that unit’s procedures. Classified Information Classified information may only be disclosed when authorized by the Director of CSIRTXX or his or her designee. In all cases, a non-disclosure agreement shall be signed which holds that any recipient of classified information be duly notified of the classification of the information they are receiving. Press Classified Information for Community Use Communication and liaison with the press will be coordinated and performed solely by the designated spokesperson of CSIRT-XX, with prior approval of the Director of CSIRT-XX or his or her designee. When contacted by any representative of the press, all members of CSIRT-XX will refer requests to the spokesperson, indicating that they are not authorized to disclose information and will not disclose any information under any circumstances regardless of the classification of the information involved. Information that is classified but still approved for dissemination within the community is a special kind of information. All considerations previously mentioned still apply, except that disclosure to certain members of the target community will be authorized by the Director of CSIRT-XX. Confidential information CSIRT-XX and its personnel will not disclose confidential information. If for operational reasons it becomes necessary to share confidential information with third parties, you shall seek the consent of the owner of the information, who may authorize disclosure or not. If the owner authorizes it, the recipient shall be required to sign a non-disclosure agreement either provided by the owner of the information or the CSIRT. Cooperation and information sharing with other incident response groups is vital to the operation and survival of CSIRT-XX and the greater national and international community of computer security incident response teams. As much information as possible will be shared with other response groups, in accordance with this policy, evaluating each case individually and with the permission of the Director of CSIRT-XX or his or her designee. MEDIA RELEASE OF SENSITIVE INFORMATION When necessary, sensitive information shall be disclosed in such a way so as to prevent access to it by an unauthorized third party. Secret information Under no circumstances will CSIRT-XX disclose secret information by law. Incomplete/Unfinished Information Information that is in a state of preparation that does not contain sensitive information may be disclosed individually following the guidelines defined for this purpose. 90 91