4. Policies
Incident support levels, information classification, disclosure rules, and authentication methods.
4.1 Types of Incidents and Level of Support
GovCERT XK is authorised to address all types of computer security incidents which occur, or threaten to occur, within its constituency.
The level of support provided will vary depending on the type and severity of the incident, the type of constituent affected, the size of the community impacted, and GovCERT XK's resources at the time — though in all cases an initial response will be made within one working day.
End users are expected to contact their own system or network administrator, or their institution's IT department, for direct assistance; GovCERT XK supports these intermediaries rather than individual end users directly.
4.2 Information Classification
GovCERT XK classifies and handles information it receives or produces according to the Traffic Light Protocol (TLP). This classification determines the audience with which information may be shared:
| Classification Level | Description |
|---|---|
| TLP:RED | For the eyes and ears of individual recipients only, no further disclosure. Not for sharing beyond the specific exchange or meeting in which it was originally shared. |
| TLP:AMBER | Limited disclosure. Recipients may share TLP:AMBER information only with members of their own organisation and with clients or constituents who need to know the information to protect themselves or prevent further harm. |
| TLP:GREEN | Limited disclosure. Recipients may share TLP:GREEN information with peers and partner organisations within their sector or community, but not via publicly accessible channels. |
| TLP:CLEAR | Recipients may share this information without restriction, subject to standard copyright rules. |
4.3 Information Disclosure and Exclusivity
Exclusivity, in this context, defines who has access to which category of information handled by GovCERT XK, and under what conditions it may be further shared.
All information received by GovCERT XK is handled confidentially, regardless of its classification level. Information that is evidently sensitive is communicated and stored only in a secure environment, using encryption where necessary.
Information is shared further only in accordance with its assigned classification level (see Section 4.2), on a strict need-to-know basis, and — where possible — in anonymised form. Information marked TLP:RED or TLP:AMBER is shared only with the specific recipients, organisation, or constituents designated by the classification, and never distributed beyond that group without the originator's explicit consent.
GovCERT XK operates within the bounds of the legislation of the Republic of Kosovo, and may be required to disclose information to competent national authorities pursuant to that legislation.
4.4 Communication and Authentication
E-mail and telephone are considered sufficiently secure for the transmission of low-sensitivity (TLP:CLEAR / TLP:GREEN) data, even unencrypted. Where it is necessary to send highly sensitive data (TLP:AMBER / TLP:RED) by e-mail, PGP encryption will be used (see Section 2.7).
Where it is necessary to authenticate a person before communicating, this may be done through existing webs of trust (e.g. Trusted Introducer, FIRST), or by other methods such as call-back, mail-back, or a face-to-face meeting.