To be confirmed as compliant with our Standards, each tester must show that potential participants were given proper notice about a subject test. We believe that using the Contact List system is the simplest and clearest way to ensure this requirement is met.
Who is the Contact List for
Participation in the AMTSO Contact List system is open to both AMTSO members and non-members.
Applications must come from companies providing products and/or services in the security space or they must represent recognized independent professional testing labs currently engaged in some form of anti-malware testing.
Anyone outside these categories may also sign up to the list, however traffic to the “all” group is likely to be minimal.
The Contact List gathers all approved and official points of contact for both testers and security product vendors in one place.
Where do notifications go
AMTSO provides multiple subdivisions of the list, as follows:
Vendors – directs mail to all product vendors registered with the AMTSO Contact List
Testers – directs mail to all testers registered with the AMTSO Contact List
All – directs mail to everyone registered with the AMTSO Contact List
If a participant wishes to get in touch with another participant directly, contact details can be requested from AMTSO. On joining the system, an option is provided to make your contact address readily accessible to AMTSO members via the private AMTSO member site.
When are notifications sent
When a test lab issues a formal notification of an upcoming test, the notification message can be submitted to AMTSO to be sent out to the Contact List participants. An option is provided to send only to vendors (for example, if a tester wishes to keep a new test design relatively private from their business rivals).
AMTSO may also use the system to distribute messages to particular groups, such as sending requests for testing services to the Testers section of the Contact List.
Which email address to use for the Contact List
The recipient address provided to the Contact List should ideally NOT be individual or personal email addresses; instead, we encourage all participants to operate internal mailing groups to direct incoming mail to the most relevant people or teams.
Example: Rather than adding both firstname.lastname@example.org and email@example.com to the Contact List, use something like firstname.lastname@example.org, and add both Steve and Dave (and anyone else who would benefit from AMTSO notifications) to the amtso_cl distribution group within your organization’s mail system.
You should also consider the addresses supplied to the AMTSO Contact List as semi-public – while we try to discourage any open sharing of the addresses included in the list, any list participant may request the contact address for any other participant, and AMTSO cannot guarantee that addresses shared in this way will be kept confidential.