RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
RFC 2350 (BCP 21, June 1998) sets out what a Computer Security Incident Response Team is expected to tell its constituency and other teams: a signed, dated, published description covering contact details and keys, a charter (mission, constituency, sponsor, authority), policies on the incidents it handles, co-operation and disclosure, secure communication and authentication, the services it offers (triage, coordination, resolution, proactive), its reporting forms and disclaimers. Its Appendix D outline is the de facto profile format CSIRTs publish and FIRST asks of membership candidates. Current and never updated.
RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) is a compliance framework from International (IETF) with 6 domains and 18 controls. The largest domains are Section 3.3: Charter – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (4 controls), Section 3.5: Services – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (4 controls), Section 2: Scope (publishing, relationships, secure communications) – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Section 2: Scope (publishing, relationships, secure communications) – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::2.1 | 2.1 Publish the CSIRT's policies and procedures to its constituency |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::2.2 | 2.2 Relationships with other CSIRTs: decide and explain what is shared |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::2.3 | 2.3 Establish secure communications and authenticate keys in advance |
Section 3.3: Charter – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.3.1 | 3.3.1 Mission statement |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.3.2 | 3.3.2 Constituency |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.3.3 | 3.3.3 Sponsoring organisation and affiliation |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.3.4 | 3.3.4 Authority |
Section 3.4: Policies – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.4.1 | 3.4.1 Types of incidents and level of support |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.4.2 | 3.4.2 Co-operation, interaction and disclosure of information |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.4.3 | 3.4.3 Communication and authentication |
Section 3.5: Services – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.5.1.1 | 3.5.1.1 Incident triage |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.5.1.2 | 3.5.1.2 Incident coordination |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.5.1.3 | 3.5.1.3 Incident resolution |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.5.2 | 3.5.2 Proactive activities |
Sections 3.1 and 3.2: Document and contact information – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.1 | 3.1 Document information: last update, notification of changes, location |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.2 | 3.2 Contact information |
Sections 3.6 and 3.7: Reporting forms and disclaimers – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)
| Code | Title |
|---|---|
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.6 | 3.6 Incident reporting forms |
| rfc-2350-expectations-for-computer-security-incident-response-bcp-21::3.7 | 3.7 Disclaimers |
What is RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) and who does it apply to?
RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) is a compliance framework from International (IETF) with 6 domains and 18 controls. RFC 2350 (BCP 21, June 1998) sets out what a Computer Security Incident Response Team is expected to tell its constituency and other teams: a signed, dated, published description covering contact details and keys, a charter (mission, constituency, sponsor, authority), policies on the incidents it handles, co-operation and disclosure, secure communication and authentication, the services it offers (triage, coordination, resolution, proactive), its reporting forms and disclaimers. Its Appendix D outline is the de facto profile format CSIRTs publish and FIRST asks of membership candidates. Current and never updated. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) actually require?
RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) has 18 controls organised across 6 domains. The largest domains are Section 3.3: Charter – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (4 controls), Section 3.5: Services – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (4 controls), Section 2: Scope (publishing, relationships, secure communications) – RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) do I already cover?
RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement RFC 2350 - Expectations for Computer Security Incident Response (BCP 21)?
Start your RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about RFC 2350 - Expectations for Computer Security Incident Response (BCP 21) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 18 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required