RFC - 2350

Expectations for Computer Security Incident Response

Original:	ftp://ftp.isi.edu/in-notes/rfc2350.txt
Authors:	N. Brownlee [The University of Auckland], E. Guttman [Sun Microsystems]
Date:	June 1998
Category:	Best Current Practice [ BCP-21 ]

---

Referred by:	9 RFC
Refers to:	2 RFC

---

Status

This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Distribution of this memo is unlimited.

Copyright Notice

Copyright (C) The Internet Society (1998). All Rights Reserved

Abstract

The purpose of this document is to express the general Internet community's expectations of Computer Security Incident Response Teams (CSIRTs). It is not possible to define a set of requirements that would be appropriate for all teams, but it is possible and helpful to list and describe the general set of topics and issues which are of concern and interest to constituent communities.

CSIRT constituents have a legitimate need and right to fully understand the policies and procedures of 'their' Computer Security Incident Response Team. One way to support this understanding is to supply detailed information which users may consider, in the form of a formal template completed by the CSIRT. An outline of such a template and a filled in example are provided.

---