Security Policies Github Sirt Description Rfc 2350 (GitHub)

[company name] [team name] description RFC 2350

Document Information

TLP: CLEAR

Date of Last Update

Version [version number], updated [last update date].

Distribution List for Notifications

There is no distribution list for changes to this document.

Locations where this Document May Be Found

The current version of this document may be found at:

[document url link]

Contact Information

Name of the Team

[team name]

Subteams:

[subteam name 1]

[subteam name 2]

[subteam name 3]

Address

[postal address]

Time Zone

Our team mainly works in the [country name] and keeps to these hours:

[timezone 1]

[timezone 2]

[timezone 3]

Telephone Number

[telephone]

Facsimile Number

[fascimile]

Other Telecommunication

[other comms]

Electronic Mail Address

[security contact email address]

This relays email to the human(s) on duty for [company name] [team name].

Public Keys and Encryption Information

[team name] has a PGP public key:

Key ID: [pgp key id]

Key expiry: [pgp key expiry date]

[pgp public key block]

Team Members

The list of team members is not publicly available.

Other Information

None available.

Points of Customer Contact

Vulnerabilities should be reported to our bug bounty program:
[program link]

[company name] customers should contact their account manager or [company name] Support for first level support and escalations:
[support link]

Other security related communications can be directed to our email address detailed in Section 2.7.

Charter

Mission Statement

[company name]is committed to maintaining the confidentiality, integrity, and availability of both its platform and the intellectual property and personal information of its users, customers, and employees. In order to ensure these principles are upheld, [company name] maintains robust vulnerability management, incident response, and threat hunting capabilities.

Constituency

Our constituency is any individual or organization that uses a [company name] product or service, as well as [company name] employees, contractors, and [company name] Inc.

Some examples of [company name] products and services are:

[product/service 1]

[product/service 2]

[product/service 3]

[product/service 4]

Sponsorship and/or Affiliation

[company name] [team name] is a team within [company name]. Funding is provided by [company name].

Authority

[company name] [team name] operates under the authority of the [ciso or relevant authority] of [company name].

Policies

Types of Incidents and Level of Support

[company name] [team name] is authorized to address all types of computer security incidents which occur, or threaten to occur, within its constituency.

The level of support depends on the type and severity of the given security incident, the number of affected entities within our constituency, and our resources at the time.

Co-operation, Interaction and Disclosure of Information

[company name] [team name] takes every effort to safely and securely share information with affected parties during incident response situations while respecting the privacy and trust of our constituents.

Communication and Authentication

[company name] [team name]makes use of the Traffic Light Protocol (TLP) for information sharing.

Email is the preferred method of communication. All sensitive information should be encrypted using the [team name] PGP key (as detailed in Section 2.8) prior to sending.

Services

This is a preview. The full template is free on GitLaw.