CERT.LV information handling policy
All incidents are considered normal priority unless they are labeled EMERGENCY. CERT.LV itself is the authority that can set and reset the EMERGENCY label. An incident can be reported to CERT.LV as EMERGENCY, but it is up to CERT.LV to decide whether or not to uphold that status.
All incoming information is handled confidentially by CERT.LV, regardless of its priority.
Information that is evidently very sensitive in nature is only communicated and stored in a secure environment, if necessary using encryption technologies. When reporting an incident of very sensitive nature, please state so explicitly (e.g. by using the label VERY SENSITIVE in the subject field of e-mail) and if possible use encryption as well. CERT.LV will use the information you provide to help solve security incidents, as all CSIRTs do or should do. This means explicitly that the information will be distributed further only on a need-to-know base, and if possible in an anonymized fashion.
If you object to this default behavior of CERT.LV, please make explicit what CERT.LV can do with the information you provide. CERT.LV will adhere to your policy, but will also point out to you if that means that CERT.LV cannot act on the information provided. CERT.LV does not report incidents to law enforcement, unless law of the Republic of Latvia requires so. CERT.LV cooperates with law enforcement in the course of an official investigation.
Usage of PGP in all cases where sensitive information is involved is highly recommended.
