FIRST Site Visit Requirements and Assessment: Tlp:White
FIRST Site Visit Requirements and Assessment: Tlp:White
1.0 April 13, 2006 Robin Ruefle (CERT Program), Damir Rajnovic (PSIRT)
2.0 August 2013 Margrete Raaum (UiO-CERT), Robin Ruefle (CERT/CC)
3.0 December 2014 Margrete Raaum (Statnett SF)
3.1 May 2020 Andrea Dufkova
The items in this site visit evaluation document are suggestions to applying teams and sponsors of
what to review during the site visit and what to look for as a way to assess of the qualifications of
the candidate team. Not all questions/categories may apply to every team. We have also added a
checklist with areas to comment on the last two pages for reporting purposes.
The candidate and the sponsor will act in good faith. The sponsor's role is to establish facts and
answer questions but not to investigate or judge.
If the candidate team passes the site visit are they a member of FIRST?
No, the site visit is only a component of the application process. The information collected during
the visit will be posted for FIRST members to review. If there are no objections after the
candidate has been reviewed by the FIRST membership, the application will go to the FIRST
Steering Committee for approval.
to FIRST Secretariat as a PDF document in a secure electronic format, signed by the sponsor. The
notes can be either typed in a document or written on a piece of paper and then scanned.
All mandatory items are marked with the word “Mandatory”. Items not marked are considered
optional.
1. General items
Each team must have a clearly defined constituency. If there is overlap with any other team, this
must be made known, and the constituency know when to engage which of the teams.
Verification of the constituency can be found in any charters, mission statements, concept of
operations documents, or similar documents that describe the CSIRT’s purpose and function.
As part of completing this requirement, the type of constituency and sector should be recorded
as “Constituency type” and “Constituency sector”, where "type" could be: internal, external or
mixed, and “sector” could be: educational, government, non-profit, critical infrastructure, military,
commercial or other.
The effective start date that the team went into operation should be recorded. This is the date on
which the team has officially started its existence. This can be included as part of the Document
of Creation discussed in item 1.5 or other documents.
The CSIRT's existence must be announced to the constituency. When a CSIRT becomes
operational there should be an announcement to its constituency declaring it so and describing
the interface with the constituency. They must know that it is exists and know how to engage and
interact with the CSIRT.
If the constituency is internal, then the announcement should be made internally. If desired and
appropriate the announcement can be made externally too. If the constituency is external, then
the announcement should be made externally.
This can be verified by reviewing the actual announcement and any subsequent descriptions
such as a web page or charter.
1.4. Defined and advertised set of services provided for the constituency
(Mandatory)
A defined set of services should explain what actions, functions, or deliverables it performs for
the constituency. It should also include any service level definitions that have been agreed to
between the CSIRT and the constituency.
Verification of a set or list of services should be accessible to the constituency via a brochure,
website, or other similar mechanism.
Funding for long-term operational, personnel, and facilities costs needs to be in place. The
funding model can be for example:
a. a cost centre within an organization (where the host or parent covers all expenses and does
not receive any revenue from it) or
b. team can be funded in whole or in part by grants, if so:
The team should detail the grant include issuer and source, purpose, amount and duration of
the grant.
c. Or the team may sell its service either internally or externally (there could be a charge-back or
fee to internal or external customers.) or
d. be funded through a consortium of organizations such as universities in a research network
This can be verified by reviewing a copy of an accepted and approved budget or other financial
documentation from the funding source.
The team’s organization can be verified by looking at a CSIRT organization chart or similar
document.
2. Policies
This section reviews various policies the CSIRT should have in place to ensure that incident data,
vulnerability information, malware/artifacts and site information is properly protected. All of
these policies should be verifiable by reviewing the policy document, along with any
corresponding procedures. Verification can also be done by interviewing staff to see if they know
and understand the policies.
The policy should specify how to categorize any information received from FIRST teams.
type of information can and cannot be discussed on mobile or non-secure devices along with
what information must be transmitted and discussed and stored in a secure fashion and should
not be shared or discussed with non-authorized persons.
This policy should also state the manner in which FIRST information should be handled,
protected, and shared within the CSIRT and its parent/host organization.
The policy should specify that any information that is sensitive, site-related, or confidential
should be destroyed only by those with approved access and must be destroyed in a manner
that it cannot be reconstituted.
This policy should discuss the type of information that can be disseminated to internal and
external groups the methods by which information should be disseminated (including how
information from FIRST coming into the CSIRT will be shared), the specific types of information
that will not be released and what information should be considered sensitive or confidential.
This policy should take into account the information disclosure restrictions that might be placed
on information provided to a CSIRT by other organizations and the parent organization, which
might have its own requirements (For example, if another CSIRT reports an incident, what can its
constituents expect regarding the disclosure of the information reported? The policy should
specify limitations, which should be made publicly available (to the constituents and other
interested parties such as law enforcement).
It should also detail who has the authority to change access and who has responsibility for
maintaining the access process.
This policy and corresponding procedures should outline the appropriate use of systems, e.g.
what is the definition of computer security incident for the CSIRT and constituency
what criteria is used to evaluate event and incident reports
what incident categories and corresponding priorities exist
how are reports, events, and incidents correlated and combined
This includes
the types of incidents that fall within the jurisdiction or expertise of the CSIRT
who handles the analysis and response
what work, if any, should be done with law enforcement
what to do with reports and activity outside the scope of the CSIRT
This policy should outline the basic process to follow in handling an incident. It should include:
If teams in a cooperative forum (e.g., ISACs, FIRST) have a competitive relationship, specific
guidance should be given as to what data can be appropriately shared and if there are any other
special provisions for how the interaction should be handled.
All locations (if there are several locations) should provide the same, or equivalent, level of
privacy and protection.
The site visit team should verify that the facilities/premise occupied by the CSIRT meets the
minimal security standards as listed in the following sections. This can be done by observation or
by reviewing descriptive documentation or blue prints. If this information is confidential, then it
must be described as much as possible by the CSIRT.
The site visit team should also make sure that all equipment, networks, and applications are used
in a manner to protect CSIRT data.
secured rooms or security operations center (SOC) for location of any CSIRT servers and data
repositories
secured and sound proof rooms for discussion of CSIRT activities and investigations
safe for storage of non-electronic data and notes
secured communications mechanisms such as secure phones, faxes, and email
physical separation of CSIRT staff from other parts of the organization
policy on accommodating visitors if not included in policy on general access control
Any incident tracking system that is used by the CSIRT should be understood by the FIRST site
visit team, since FIRST data may go in this tracking system. Specifically the following issues should
be described, if not evident from the tracking system used:
Questions about PGP should cover whether in addition to the team key, all have their individual
keys and general key policies cound include e.g.
4. Incident handling
The site visit team should review methods, processes, and technologies used by the CSIRT to
handle incidents to ensure formalized procedures are in place that protect CSIRT data and allow
efficient incident handling.
Incident reporting guidelines are written for the constituency and should outline the type of
incidents that should be reported and the manner in which they should be reported.
who should receive the reports: the CSIRT directly, a centralized helpdesk, or some other
group
the exact method and procedures for submitting the information: via a form, via email, via
phone calls
the fields of information to be captured such as
contact information
time and date of report (including time zone information)
timeframe and date of activity
systems affected [OS version, patch level, purpose]
brief description of problem or activity
any time requirements for submitting reports
any other specifics for the CSIRT
Assigned
Analyzed
Escalated
Closed
Reviewed for lessons learned
Questions to be asked may include:
This may be verified by reviewing any published contact information in brochures, employee
handbooks, web sites or other similar communications.
Questions include:
Is there publicly advertised contact information? What is it? Including any URLs or email
addresses or phone numbers.
Are staff given time and resources to attend conferences and training?
How is training tracked and regulated?
Do job descriptions list required skills and abilities?
Is there a professional development program?
The Primary Sponsor may acknowledge the following items were reviewed with the applying
team during the site visit and their response meets FIRST standards.
1. General items
______ We have reviewed the following items with the applying team.
1.1. Defined constituency
1.2. Mission statement or charter
1.3. Document of creation, effective start date, and announcement
1.4. Defined and advertised set of services provided for the constituency?
1.5. A Funding model is in place
1.6. Organizational Home
1.7. How the team is organized with the parent organization
Comments:
2. Policies
______ We have reviewed the following policies the CSIRT should have in place to ensure incident,
vulnerability, artifact, and site information is protected and secured. All of these policies can be
verified by reviewing the policy document in writing, along with any corresponding procedures
including:
2.1. Information classification
2.2. Information protection
2.3. Record retentions
2.4. Record destruction
2.5. Information dissemination
2.6. Access to information
2.7. Appropriate usage of CSIRT’s system
2.8. Computer Security Events and Incidents Definition
2.9. Incident handling policy
2.10. Cooperation with other teams
Comments:
4. Incident handling
______ We have reviewed the methods, processes, and technologies used by the CSIRT to handle
incidents. We have ensured formalized procedures are in place that protect CSIRT data and allow
efficient incident handling including:
4.1. How to report an incident
4.2. Incident Handling Process
4.3. Acknowledging report
Comments:
6. Professional development
______ The applying team participates in ongoing training.
6.1. Training
6.2. Conferences
Comments:
______ I (sponsor) am familiar with the way the candidate team operates and attest that the
applying team satisfies the minimum requirements for FIRST membership.
______ I (sponsor) have met the applying team and presented FIRST and answered their questions.
______ I (sponsor) have reviewed applicant’s critical operational and managerial issues and
acknowledge they are up to FIRST standards.
______ I (sponsor) have had working interaction with the applying team.
______ I (sponsor) have explained the confidentiality of the information that is passed within FIRST
and the applicant agrees to comply with those policies outlined in the Operational Framework.
Any other comments/recommendations:
Name:: Name:
Title: Title:
Signature: Signature:
Date: Date: