Policy SIG

Mission

The Policy SIG formulates and promotes FIRST's position on policy and governance matters in an international context. It advocates the values of FIRST and supports policymakers with factual information, enabling them to understand the needs of incident responders and the importance of global cooperation in securing cyberspace. The SIG promotes FIRST initiatives, but does not lobby. SIG members can, with the approval of the board, represent FIRST in relevant meetings to promote FIRST's position and values. The SIG formulates and documents FIRST's policy position and maintains the FIRST policymaker training.

Goals & Deliverables

Describe the goals and deliverables of what you hope to accomplish in the next year (please explain if a longer approach is needed). Cybersecurity has long been not only a technical topic, but also a governance issue. As early as 2003, the UN Governmental Group of Experts on the use of ICTs began discussing cybersecurity issues. This culminated in the statement that international law holds in cyberspace and the identification of eleven norms of responsible state behavior. At the same time, regional organizations such as the Organization for Security and Cooperation in Europe (OSCE) started working on Confidence Building Measures (CBMs) with the goal of improving collaboration in cybersecurity matters among participating states. The subsequent UN Groups of Governmental Experts (GGEs) as well as the more inclusive Open-Ended Working Group (OEWG) further developed this into the UN Framework for responsible behavior in cyberspace, which rests on four pillars:

  1. International law holds in cyberspace
  2. States should implement the eleven norms of responsible state behavior
  3. States should implement CBMs
  4. States should invest in capacity building

The UN framework touches on FIRST's work in many areas. For example, FIRST's code of ethics (ethicsFIRST) is rooted in international law, namely the Universal Declaration of Human Rights. Furthermore, CERTs are explicitly mentioned in existing norms and CBMs. FIRST operates its own capacity building program. For these reasons, FIRST has contributed for many years to policy processes and discussed its stance in an informal group of interested volunteers. FIRST is increasingly recognized as a key stakeholder in discussions around cybersecurity and incident response. Its global scope gives the organization a reputation of being competent and neutral. Thus, we would like to create a formal special interest group (SIG) to help advising on FIRST's position and engagement in governance and policy matters.

Chairs

Mailing list

Request to Join