Summary

  • FIRST's Board controls the corporation, admission of full member teams, fees, committees, standards publication and institutional speech. The bylaws also state that FIRST has no authority over how a member team is organized or operated.
  • Practical influence comes from controlling trusted access, common labels, convening infrastructure and the reputation of membership. TLP tells recipients how a source expects information to circulate; it is not a legal classification and cannot order an operator to take action.
  • The published design is legitimate as a private association's mandate, but narrower than a command mandate over incident response. Current public records do not show admission outcome statistics, revocation precedents, issue-level conflicts or the downstream effect of crisis coordination.

A corporation that organizes trust

The Forum of Incident Response and Security Teams is a North Carolina nonprofit corporation. Its current bylaws place all corporate powers under a ten-person Board. Five directors are elected each year for two-year terms; a sixth nomination is required, and the five candidates receiving the most votes win. The Board then chooses its officers.

That is a real grant of authority, but its source is specific. Full FIRST Members vote on corporate matters. Associates and Individual Members do not. The current public Board roster includes two directors whose membership class is listed as Individual Member. That is permitted by the published rules; it also means Board eligibility and corporate voting rights are not identical concepts.

The Board's formal powers are broad inside the association. It admits teams as full Members, establishes dues, creates and dissolves committees or special-interest groups, authorizes publication of standards and can authorize the Secretariat or another participant to speak for FIRST. It may suspend, revoke or restore membership by a two-thirds vote. The member receives notice and may present a rebuttal before revocation.

The boundary is just as explicit. Each member team remains responsible to its own constituency. The bylaws say FIRST has no authority over the organization or operation of a member team. FIRST can decide who carries its institutional name. It cannot take control of a national CSIRT, a bank's response unit, a vendor team or a network operator merely because that team participates.

This is the central separation: FIRST governs the club and its common channels; member teams govern incidents under their own legal and operational mandates.

Admission is a chain, not an open door

The current team-membership process is detailed enough to locate the gatekeepers. A typical applicant first identifies two existing full Members willing to sponsor it. FIRST normally requires a site visit. The Secretariat checks the dossier, the Membership Committee reviews it, existing Members receive a comment period, objections may be raised, and the Board takes the final vote. Admission requires two-thirds of all directors, not merely two-thirds of those present.

FIRST describes the sequence as roughly five months and publishes a fifteen-step diagram. The procedure gives an applicant that receives an objection an opportunity to respond, revise and reapply. It does not publish an independent appeal route outside the same institutional chain.

Sponsorship and site visits have a defensible function. Incident-response trust cannot be established by a web form alone. A team asking for sensitive warnings should be operationally reachable, securely handled and accountable to a real constituency. Existing teams can test claims that a distant Secretariat cannot readily verify.

The same controls create incumbent power. A capable applicant without two willing sponsors faces a higher entry cost. A visit consumes time and money. Existing Members can object before the Board vote. The Membership Committee and Secretariat preserve continuity and decide whether a file is ready to advance. The Board makes the decisive institutional judgment.

The public record captured for this article does not disclose annual totals for applications, withdrawals, objections, rejected applicants, processing time by region or successful reapplications. Nor does it disclose standardized reasons from Board votes. Their absence does not establish discriminatory admission. It prevents an outsider from testing whether published criteria produce consistent outcomes across geography, sector or institutional familiarity.

The ballot grants corporate authority, not operational command

The 15 June 2026 AGM update identifies five directors elected for 2026–2028 and five continuing their 2025–2027 terms. It also records post-election officer appointments and bylaw amendments. The current Board page assigns portfolios ranging from finance and membership to standards, education and community engagement.

One current director responsible for community engagement is listed with LACNIC as her affiliation. That published affiliation is why this article links to the existing LACNIC directory entry. It does not show that LACNIC directs FIRST, that the director acts as a LACNIC delegate, or that one regional registry represents the member base. An affiliation is evidence of an institutional connection, not a delegation instrument.

The election rule is simple, but the available public evidence is incomplete for assessing representation. The captured sources do not supply turnout, vote totals, candidate statements in a durable election archive, campaign finance, regional concentration of eligible voters or the share of Members that nominated candidates. FIRST's global reach and Board diversity can be described. They cannot substitute for those measures.

The legitimate claim is therefore limited. Members authorize the Board to govern FIRST as a corporation. This mandate does not arise from Internet users, governments, number-resource holders or all incident-response teams. Those constituencies may benefit from FIRST's work without having cast a corporate vote.

TLP regulates expectations, not systems

The Traffic Light Protocol is one of FIRST's most visible forms of influence. TLP 2.0 supplies four labels—CLEAR, GREEN, AMBER and RED—and a narrower AMBER+STRICT option. A source uses them to tell recipients how far information may be shared. The source retains control over widening distribution.

FIRST's own standard states what TLP is not. It is not a formal classification scheme. It does not alter freedom-of-information duties or other applicable law. It is not a licensing device. The label supplies a common expectation inside a trust relationship.

That distinction matters in a crisis. A TLP:RED message can reduce accidental disclosure and keep a sensitive fact inside a meeting. It cannot compel an ISP to filter traffic, a registry to change a record, a government team to notify the public or a vendor to patch a product. Those decisions remain with actors that hold system access, statutory authority, contracts and operational responsibility.

The source's control can also impose costs. A label that is too restrictive may slow defensive circulation. A label that is too permissive may expose victims, methods or vulnerable systems. The recipient bears the burden of interpreting the label alongside law, contract and internal policy. FIRST supplies the vocabulary; it does not absorb every consequence of its use.

The TLP special-interest group and the standards process convert repeated practice into durable institutional language. The Board controls whether a document becomes a FIRST standard. This is soft power with a hard distribution mechanism: tools, policies and incident workflows can embed the labels long after the participants who designed them have changed.

Infrastructure is a control surface

FIRST's infrastructure page names more than a website. It describes a member portal, identity services, an API, group controls, Slack, MISP and other services that carry membership and sharing activity. Its 2025 annual report says the organization migrated workloads to AWS, improved privacy and group controls, expanded DDoS protection, developed a support platform and continued a NatCSIRT service.

These are self-reported operating claims, not an independent resilience audit. They nevertheless identify where practical power sits. Identity controls decide who can authenticate. Profiles tell other participants who a team is. Group permissions determine where a warning can travel. APIs and collaboration tools lower the cost of using FIRST's trust graph instead of building a parallel one.

The report counted 834 teams, four Associates and 205 Individual Members across 115 countries in one section. Its introductory material used 113 countries. The discrepancy is preserved here because the source does not reconcile it. Neither figure proves active participation, response quality or geographic equality.

Scale creates benefits and lock-in at the same time. More verified teams make the network more useful. More use produces more profiles, relationships, shared conventions and event history. Leaving then means losing not a statutory permission, but a accumulated package of access, recognition and interoperability. A substitute network must rebuild the trust graph as well as the software.

Speech is centralized; action remains distributed

FIRST's press policy directs media enquiries to the Secretariat. The bylaws permit the Board to authorize the Secretariat or another participant to speak on the association's behalf. That is sensible brand governance: a global incident should not produce dozens of contradictory claims carrying the same institutional name.

It also creates an accountability question. Institutional silence, a narrow statement or a delayed clarification is a Board-and-Secretariat choice even when underlying operational facts belong to members. Conversely, a statement by one member team is not automatically FIRST's position. The public needs to distinguish four records: what a source shared, what FIRST communicated, what a member team decided and what an affected operator executed.

The present sources do not provide a complete crisis-by-crisis disposition trail joining those four records. They do not show how often FIRST's coordination changed a member's action, which team declined advice, what cost followed, or whether a public statement was constrained by a member interest. Those are unknowns, not grounds to invent motive.

The conflict-of-interest policy is also narrower than a general governance code. Its published text focuses on financial interests in transactions involving the corporation. It supplies disclosure, review and documentation rules for that scope. The captured record does not show a public issue-level register for standards choices, admissions, crisis statements or committee participation. This observation does not establish an undisclosed conflict. It identifies a category of decision that the public policy does not transparently resolve.

Who pays, who gains

Applicants pay dues, sponsorship and verification costs. Members contribute staff time to visits, committees, standards and events. The Secretariat and infrastructure teams carry operational continuity. Sources accept the risk of sharing sensitive information. Recipients bear the risk of sharing too widely—or too slowly. Operators and the public bear residual incident harm.

The beneficiaries are also distributed. Member teams gain trusted reach and professional recognition. FIRST gains dues, legitimacy and a wider evidence network. Vendors, governments, registries and operators gain a common vocabulary and a channel through which counterpart teams may be found quickly. Incumbents also gain the power to sponsor, comment and vote; Board members gain control over institutional choices.

For number-resource holders, FIRST has no power to allocate an ASN or prefix and no authority to set RIR policy. Its relevance lies in the response layer around those resources. A route leak, hijack, abuse campaign or compromised network may require rapid contact between an operator, a CSIRT, a registry and law-enforcement or vendor teams. FIRST can lower the search and trust cost. It cannot replace the legal or technical authority of the actor able to change the route, registry record, host or device.

Sources