1 Methodology for creating the institutional framework The institutional framework of the National CSIRT is key to its establishment and function throughout its lifecycle. As stated above, National CSIRTs may be set up in different ways, but they will have traits in common. It is important that the country adopt a CSIRT structure that fits the its legal, political, and cultural realities. Once stakeholders, mission, and vision are established, the project team must identify where the National CSIRT will be established. The team must be located in an institution that: A National CSIRT’s institutional framework will set guidelines for the following considerations: • • • • • • • Responsibilities Authority Interaction with stakeholders Financial resources Human Resources Infrastructure Resilience An aspect often overlooked when establishing a CSIRT is funding. It seems obvious, but a national incident response team without a steady source of funding will not be able to function beyond the short term. For this reason, while securing seed or startup funding is pivotal, the project team must also make projections of how much money will be needed to finance the team after initial costs are met to sustain it.12 A B C D • Has the ability to establish or influence ICT-security related policies at the national level • Resides close enough to the highest levels of government that it can enlist its support when needed • Is able to secure funding • Has appropriate jurisdiction and autonomy when needed Due to the cross-cutting nature of issues with which a CSIRT works, a multidisciplinary group shall be formed to determine where the CSIRT shall sit. It should be composed of experts in: A National CSIRT with a coordinating role must be located in an office or body that has contact and influence with a range of stakeholders. Otherwise, it will be difficult to execute and communicate the response team’s work. As with most things described in this guide, the CSIRT’s location will depend on the structure of its government. In Latin America, CSIRTs are housed in a variety of institutions. In Brazil, Panama, and Uruguay, for example, the teams are in executive bodies under the Presidency. In Colombia and Peru, the Ministries of Defense and Security handle national incident response. Still, in other countries like Paraguay, the CSIRT operates from the Ministry of Technology. The fact that a team is part of government should in no way preclude it from information sharing and strategizing with the private sector and other actors. In fact, many CSIRTs form steering committees or boards comprised of select stakeholders that debate and discuss key decisions facing the response team. While some CSIRTs accept decisions of their committees as binding, others use them simply as a forum for debate and collaboration, with the final decision ultimately residing with the team. 34 PLANNING Institutional Framework Establishment • • • • • Computer Security and Incident Response Public Policy in Technology and Telecommunications National Security and Defense Public Law Legal Framework The project team must recommend: • Whether the CSIRT will be an independent organization, whose sole purpose is to be a National CSIRT, or a division within another organization • Whether the CSIRT will be solely a state organization or include private-sector, academia and/or civil society participation • If there is third-party involvement, exactly how it will take place and what the associated business model will be • How the organization’s funding structure will look and how it will be secured. • How the coordination/steering committee will be formed and what powers it will have As with other processes, discussions should be annotated so as to promote transparency and increase stakeholder buy-in. The final recommendations agreed upon by this working group, together with the mission and vision, will be unified into a single document, which will then be reviewed by legal experts to establish its implementation. Due to the cross-cutting nature of issues with which a CSIRT works, a multidisciplinary group shall be formed to determine where the CSIRT shall sit 35