2 CSIRT policies are central to its operation. They are guidelines to be followed by its staff in performing operations and reflect the guidelines of the CSIRT sponsors, govern the operation and activities of the response center, and ensure the confidentiality, availability and integrity of the CSIRT information and resources, as well as the quality of its services. The policies of a CSIRT, in addition to serving as a guide for its employees and target community, are useful resources for members of the target community, since they detail when a CSIRT provides what type of services and how it maintains and protects the information it manages. FIRST, the largest international forum of CSIRTs in the world, has the following minimum mandatory policies for a CSIRT that wishes to become a member of the community. Mandatory Minimum Policies Information Classification Policy This policy defines how the CSIRT classifies information and differentiates between secret, sensitive, confidential and public information. B C D Definition Incident Management Policy This policy defines how to protect information according to its assigned. Information Retention Policy Cooperation Policy This policy defines how long the CSIRT should keep records or other information in its possession. This policy defines what other entities the CSIRT will cooperate with and how it will do so, particularly other incident response teams. Information Protection Policy Information Destruction Policy This policy defines how the CSIRT destroys information, records, media, devices, etc. to ensure that information is protected when its life cycle or the media containing it comes to an end. Information Disclosure Policy This policy should specify how and when the CSIRT may share or distribute information internally or externally. Policy on Access to Information This policy establishes who can access CSIRT information, taking into account CSIRT staff, members of the target community, or personnel from the CSIRT’s parent organization (if it has one). This policy defines the acceptable use of CSIRT equipment and resources, specifically how, when and for what facilities and equipment can be used. A This policy outlines the criteria that determine the definition of a security event or incident and the classification of each by type and severity. This policy should define how incident management occurs, including the type of incidents the CSIRT will answer, acceptable response times, procedures to be applied, etc. Appropriate Use of CSIRT Systems Policy 80 Definition of Security Incidents and Events Policy IMPLEMENTATION Operational polices and procedures D Other Policies In addition to the minimum policies required for a CSIRT, there may be others in order to improve the quality of services and the operation of the Center: • • • • • • • • • • • • • Internet Use Policy Incident Reporting Policy CSIRT Communication Policy Training and Education Policy Personal Computer Security Policy Computer Network Security Policy Email Use policy Mobile Device Use Policy Telecommunications Equipment Security Policy Backup Policy Segregation of Roles Policy Change Management Policy Password Policy The annexes contain more policy examples. 81