Collaboration Agreements with Other Organizations
Formal agreements between CSIRTs
No CSIRT operates in isolation: incidents frequently involve vendors, customers or other organizations in the same sector. Collaboration agreements formalize how and under what conditions sensitive information is shared during an incident, including confidentiality clauses, mutual response times and authorized contact channels. They usually take the form of memoranda of understanding (MOUs) or information-sharing agreements, and are especially relevant with critical infrastructure providers, other sector CSIRTs and law enforcement. Negotiating these agreements before an incident happens, and not during the crisis, saves critical time and avoids legal friction when evidence needs to be shared or joint containment coordinated with another organization.