Common use of Collaboration and Support for Response Clause in Contracts

Collaboration and Support for Response. There is a need to help rail security stakeholders collaborate concerning response and requires critical information sharing (both incidents and potential threats) – especially for trans-border incidents (same risk/attack in different countries / organisations). • At detection of an intrusion or an attempted intrusion, rail needs to share between security teams in all relevant rail IM/RU “instantly” or near-instantly. • Rail needs a way of exchanging information rather than “coordinating” a response, since the actual response will be decided by the IM/RU and their internal experts. • Rail needs a “virtual” team, not an “organisation” - with clear tasks and functions to support information exchange for collaboration. A legal framework may be required. • Further exchanges (IOC, architectural problems / solutions, etc.) would add benefit. • Short term emergency situations need more than the ▇▇-▇▇▇▇ model. • Further collaboration between security stakeholders can use the ▇▇-▇▇▇▇, CSIRT Network, FIRST etc.

Collaboration and Support for Response. There is a need to help rail security stakeholders collaborate concerning response and requires critical information sharing (both incidents and potential threats) – especially for trans-border incidents (same risk/attack in different countries / organisations). • At detection of an intrusion or an attempted intrusion, rail needs to share between security teams in all relevant rail IM/RU “instantly” or near-instantly. • Rail needs a way of exchanging information rather than “coordinating” a response, since the actual response will be decided by the IM/RU and their internal experts. • Rail needs a “virtual” team, not an “organisation” - with clear tasks and functions to support information exchange for collaboration. A legal framework may be required. • Further exchanges (IOC, architectural problems / solutions, etc.) would add benefit. • Short term emergency situations need more than the ▇▇-▇▇▇▇ ISAC model. • Further collaboration between security stakeholders can use the ▇▇-▇▇▇▇ISAC, CSIRT Network, FIRST etc.