[company name] [team name] description RFC 2350

Document Information

TLP: CLEAR

Date of Last Update

Version [version number], updated [last update date].

Distribution List for Notifications

There is no distribution list for changes to this document.

Locations where this Document May Be Found

The current version of this document may be found at:

[document url link]

Contact Information

Name of the Team

[team name]

Subteams:

[subteam name 1]

[subteam name 2]

[subteam name 3]

Address

[postal address]

Time Zone

Our team mainly works in the [country name] and keeps to these hours:

[timezone 1]

[timezone 2]

[timezone 3]

Telephone Number

[telephone]

Facsimile Number

[fascimile]

Other Telecommunication

[other comms]

Electronic Mail Address

[security contact email address]

This relays email to the human(s) on duty for [company name] [team name].

Public Keys and Encryption Information

[team name] has a PGP public key:

Key ID: [pgp key id]

Key expiry: [pgp key expiry date]

[pgp public key block]

Team Members

The list of team members is not publicly available.

Other Information

None available.

Points of Customer Contact

Vulnerabilities should be reported to our bug bounty program:
[program link]

[company name] customers should contact their account manager or [company name] Support for first level support and escalations:
[support link]

Other security related communications can be directed to our email address detailed in Section 2.7.

Charter

Mission Statement

[company name]is committed to maintaining the confidentiality, integrity, and availability of both its platform and the intellectual property and personal information of its users, customers, and employees. In order to ensure these principles are upheld, [company name] maintains robust vulnerability management, incident response, and threat hunting capabilities.

Constituency

Our constituency is any individual or organization that uses a [company name] product or service, as well as [company name] employees, contractors, and [company name] Inc.

Some examples of [company name] products and services are:

[product/service 1]

[product/service 2]

[product/service 3]

[product/service 4]

Sponsorship and/or Affiliation

[company name] [team name] is a team within [company name]. Funding is provided by [company name].

Authority

[company name] [team name] operates under the authority of the [ciso or relevant authority] of [company name].

Policies

Types of Incidents and Level of Support

[company name] [team name] is authorized to address all types of computer security incidents which occur, or threaten to occur, within its constituency.

The level of support depends on the type and severity of the given security incident, the number of affected entities within our constituency, and our resources at the time.

Co-operation, Interaction and Disclosure of Information

[company name] [team name] takes every effort to safely and securely share information with affected parties during incident response situations while respecting the privacy and trust of our constituents.

Communication and Authentication

[company name] [team name]makes use of the Traffic Light Protocol (TLP) for information sharing.

Email is the preferred method of communication. All sensitive information should be encrypted using the [team name] PGP key (as detailed in Section 2.8) prior to sending.

Services

Incident Response

[team name] is responsible for incident response internally at [company name] where at least one member of the constituency is affected.

[team name] does not provide incident response services for customers. Every effort is made to provide timely and accurate information during security incidents to affected customers so they can conduct their own investigations and respond appropriately. See section 2.11 for customer points of contact.

Incident Triage

[team name] carries out the following activities for incident triage:

Security signals are collected and interpreted to determine risk, severity, and priority.

Investigation as to whether an incident occurred and what its effect and impact was.

This list is not exhaustive.

Incident Coordination

[team name] carries out the following activities for incident coordination:

Situational awareness and analysis for stakeholders such as engineering, legal, and support teams.

Command role with authority to direct resources as required.

External coordination with affected or involved third-parties.

This list is not exhaustive.

Incident Resolution

[team name] carries out the following activities for incident resolution:

Engages relevant internal teams to eradicate, restore, and secure.

Collection and storage of evidence for internal use as well as potential law enforcement involvement.

Notification to affected constituents.

Postmortem authoring with lessons learned and post-incident repair items.

This list is not exhaustive.

Proactive Activities

[team name] develops, maintains, and operates threat hunting and detection tools and techniques to proactively identify risks and threats.

Work is also done on education, preparation, workflow development, and community outreach.

Incident Reporting Forms

[incident reporting form link or none available]. Please review Section 2.11 for reporting guidance.

Disclaimers

While every precaution will be taken in the preparation of information, notifications and alerts, [team name] assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.