Version 2 (April 202
TLP:CLEAR

Draft FIRST Code of Ethics and Professional
Conduct
Members of incident response and security teams (Teams) have access to many digital systems
and sources of information. Their actions can change the world. As a member of this profession,a Team member must recognise responsibility to their constituency and to other security
professionals, as well as to wider society. The individual must also recognize their responsibility
to their own well-being.
This Code is designed to inspire and guide the ethical conduct of all Team members, including
current and potential practitioners, instructors, students, inﬂuencers, and anyone who uses
computing technology in an impactful way. The Code includes principles formulated asstatements of responsibility, based on the understanding that the public good is always theprimary consideration. Each principle is supplemented by guidelines, which provide explanations
to assist computing professionals in understanding and applying the principle.
The duties are introduced below, but are not in order of importance. These duties should not beseen as absolute requirements, but rather as stated in the IETF RFC2119 for the deﬁnition of“SHOULD”:“there may exist valid reasons in particular circumstances to ignore a particular item, but
the full implications must be understood and carefully weighed before choosing adiﬀerent course.”
For more information on how to deal with possible dilemmas see Appendix A.

Duty of trustworthiness
Trust is the basis of many relations between Teams, and is often required before meaningfulexchange of information can occur. The FIRST community is built on this trust, and can onlycontinue to function in this way if there can be a reasonable level of trust between Teams.
Trustworthiness means that team members should only: 1) enter into commitments that theycan keep, 2) behave predictably towards other Teams (e.g., respect the TLP standard), and 3)
uphold the trust relationship they have with other Teams.
The trust relationship should be initially assumed and transitive, i.e., Trust on First Use (TOFU),
and enable trust of Teams that are trusted by other Teams.

Draft FIRST Code of Ethics and Professional Conduct
https://www.ﬁrst.org
1 of 5

TLP:CLEARTLP:CLEAR

Duty of coordinated vulnerability disclosure
Team members who learn of a vulnerability should follow coordinated vulnerability disclosure bycooperating with stakeholders to remediate the security vulnerability and minimize harm
associated with disclosure. Stakeholders include but are not limited to the vulnerability reporter,aﬀected vendor(s), coordinators, defenders, and downstream customers, partners and users.
Team members should coordinate with appropriate stakeholders to agree upon clear timelines
and expectations for the release of information, providing enough details to allow users toevaluate their risk and take actionable defensive measures.

Duty of confidentiality
Team members have a duty to maintain conﬁdentiality where appropriate. Requests to keep
certain information in conﬁdence may be made explicit, for example with the Traﬃc Light
Protocol (TLP). Team members should respect such requests whenever possible. If it is notpossible to keep information in conﬁdence, for example due to conﬂicts with the requirements oflocal laws, contracts, or a duty to inform, the team member should inform the information ownerof this conﬂict immediately.
Some duties of conﬁdentiality are based on laws, regulations, or customs. If, during an incident
response, some parties are bound by or expect conﬁdentiality based on such considerations,they should do their best to make these expectations explicit up front. Then all parties should
abide by the above expectation to maintain explicit requests to keep information in conﬁdence
when possible.

Duty to acknowledge
Teams receive information from many diﬀerent sources: researchers, customers, other Teams,
government entities, etc. Team members should respond to inquiries in a timely manner, even if
it is only to conﬁrm that the request has been received. When possible, Team members should
set expectations for the next update.

Duty of authorization
Team members have a legitimate need and right to understand their areas of responsibilities,
acting only on systems that they are authorised to access. Team members need to be aware of
how their actions may aﬀect their constituents, and ensure they do not cause additional harm
while performing their duties. Possible consequences of these actions should be explained to theaﬀected stakeholders. Where possible, constituents should be consulted before changes are
made to their systems.

Duty to inform
Team members should consider it their duty to keep their constituents informed about current
security threats and risks. When Team members have information that can either adversely
aﬀect or improve safety and security, they have a duty to inform relevant parties or others whocan help, with appropriate eﬀort, while duly considering conﬁdentiality, privacy laws andregulations, or other obligations.
Draft FIRST Code of Ethics and Professional Conduct
https://www.ﬁrst.org2 of 5

TLP:CLEARTLP:CLEAR

Duty to respect human rights
Team members should be aware that their actions may impact human rights of others, bysharing information, possible bias in their actions, or by infringing property rights. Teammembers have access to a wide range of personal, sensitive and conﬁdential information in thecourse of handling incidents. This information should be handled in a way to uphold humanrights.
During incident handling, responders should not act in a biased manner and should do theirutmost to eliminate bias from their processes and decision making, either performed byresponders or built into algorithms.
For the purpose of this principle, the notion of 'property' (UN Declaration of Human Rights:Article 17) includes intangibles such as intellectual property as well as ideas and concepts ingeneral, regardless of whether they are legally protected (e.g., patented).

Duty to team healthTeams have a responsibility to be able to continue to provide the services they have promised toprovide to their constituents. This responsibility includes the physical and emotional health of theTeam.
In order to both respect as persons the members which make up a Team and enable the longterm viability of sustaining an adequate level of service, a Team should strive to maintain ahealthy, safe, and positive work environment that supports the physical and emotional health of(all) its members. In order to respond to a crisis, “normal” operations should support emotional
health and stress reduction.

Duty to team ability
Incident management is an evolving subject that team members should continually study. ATeam should provide resources to its members for them to study, apply, and advancetechnological and scientiﬁc knowledge within their area(s) of responsibility. Training or
educational CPE/CEU credits may contribute, but mere compliance exercises are not suﬃcient tofulﬁl this duty. A Team should maintain suﬃcient technological infrastructure so as to enable its
services, including adequate measures to protect that infrastructure from interference by outsideparties.

Duty for responsible collection
Data collection is necessary for incident response, but a balance should be struck between thegoal of incident response and respecting the data stakeholders.
During an investigation, the amount of information needed to collect may change. While
progressing through an incident, team members should adjust what they are collecting as theneed changes.
Data not directly relevant to an incident and its remediation should be excluded from reporting.
Draft FIRST Code of Ethics and Professional Conduct
https://www.ﬁrst.org
3 of 5

TLP:CLEARTLP:CLEAR
Collected and extracted data have to be handled in accordance with applicable laws and respectof user(s) privacy. Permission should be sought before collecting and processing data under thecontrol of a data owner. Applicable law and regulations in handling data should be respected.
Data that might help other response teams in their eﬀorts related to other incidents, should bemade available to them, possibly in redacted form. Information that is conﬁdential andproprietary should only be made available with appropriate protections.
Before sharing data with third parties for mitigation, the risks should be gauged against thebeneﬁts. Data should only be shared if the beneﬁt clearly outweighs the risks. Sensitive data
should be stored so that it can easily be destroyed after an incident has been closed. Collected
data should be safely destroyed in accordance with data retention policies.

Duty to recognize jurisdictional boundaries
Team members should recognize and respect the jurisdictional boundaries, legal rights, rules,and authorities of the parties involved in incident response related activities.
Laws, regulations, and other legal issues, such as those related to privacy protection or data
breach notiﬁcations, may diﬀer between the involved jurisdictions. Jurisdictional boundaries may
be determined by the involved parties' physical locations, such as their countries or domiciles, aswell as by other factors concerning those parties. Even within a single country, laws andregulations may diﬀer between political regions (e.g., between individual states in the USA) or
between diﬀerent businesses, industries, or sectors within that nation (e.g., healthcare, ﬁnancialservices; government facilities). National CSIRTs may have designated responsibilities and/orauthority for activities involving constituents within their own jurisdiction, and they may alsocollaborate with or "hand oﬀ" information and activities to other entities that have authority forjurisdictions that cross boundaries.
Team members should be aware of key issues that aﬀect the involved jurisdictions, including but
not limited to privacy regulations or data breach notiﬁcation requirements. Because
cybersecurity and privacy laws and regulations evolve and continue to be updated worldwide, itis advisable to consult with informed legal counsel for guidance whenever issues involve multiple
jurisdictional boundaries.

Duty of evidence based reasoning
Teams should operate on the basis of veriﬁable facts. When sharing information, such as
indicators of compromise (IOCs) or incident descriptions, Team members should provideevidence and scope transparently. If this is not possible, the reasons for not sharing this evidence
and scope should be given with the information.
Team members should refrain from spreading or sharing rumours. Any hypothesis should clearlybe marked as such.
Transparent evidence and reasoning processes are important even in the case of automatedsharing, e.g., during automated sharing of large amounts of information. In this case, adescription of the data mining process should be communicated at an intelligible level of detail.
Draft FIRST Code of Ethics and Professional Conduct
https://www.ﬁrst.org
4 of 5

TLP:CLEARTLP:CLEAR

Appendix A
Dealing with Dilemmas
Team members frequently may ﬁnd themselves in a position where no action seems to satisfy allof the ethical principles. In such a situation, a choice has to be made as to which of the principles
to prioritize. In this situation, incident handlers are encouraged to reﬂect on which stakeholders,and how such stakeholders may be aﬀected by their actions, preferably in a discussion with acolleague. As a rule, the solution that minimizes the infringement of this Code should be chosen.
At times, this might not be possible, e.g., due to external pressures. In such a situation, it isrecommended to proceed, making note of the ethical dilemma, possibly under protest.

Draft FIRST Code of Ethics and Professional Conduct
https://www.ﬁrst.org
5 of 5

TLP:CLEAR