Article 4 Terms and conditions for applying cybersecurity-related grounds in relation to a specific CSIRT

This article deals with a more targeted scenario compared to Article 3, which addresses delays in dissemination broadly.

Here, the focus is on situations where the CSIRT initially receiving the notification may withhold sharing notification information with a specific relevant CSIRT, rather than all relevant CSIRTs.

The basis for this targeted delay is concern over that specific CSIRT's ability to maintain the confidentiality of the notified information, either because it has suffered a cybersecurity incident or because its general capabilities are considered inadequate.

The article also sets out the conditions under which dissemination may resume, tying the end of the delay to the relevant CSIRT demonstrating that the confidentiality concern has been resolved.

Important points:

• The CSIRT initially receiving the notification may delay dissemination to a specific relevant CSIRT if that CSIRT has been hit by a cybersecurity incident or is considered to lack adequate capability to protect the confidentiality of the information.
• The delay triggered by a cybersecurity incident lasts until the affected CSIRT notifies the CSIRTs Network that its confidentiality capabilities have been restored.
• Where the delay is based on inadequate capabilities, the relevant CSIRT must provide evidence that it has addressed the identified shortcomings before dissemination resumes.