The primary integer values (and hence the integer-valued Unicode labels) assigned to child OIDs are the values of the numeric-3 codes of ISO 3166-1 (without leading zeros) for a United Nations (UN) Member State. Secondary identifiers and non-integer Unicode labels are the (two letter) alpha-2 code elements of ISO 3166-1 (in capitals for the Unicode labels).
Note: The existence of a country code in ISO 3166-1 does not necessarily imply that there is an agency in that country which can allocate subsequent OIDs for the identification of national cybersecurity information. ISO 3166-1 also assigns codes to regions or areas, but for the purpose of this Recommendation, an arc shall only be assigned to an ITU Member State.
Each ITU Member State has a child OID automatically allocated under this OID. However, to be able to use it, the ITU Member State shall nominate a national Registration Authority (RA) for that child OID and inform ITU-T Q.4/17 by sending a letter based on the template given in Rec. ITU-T X.1500.1, clause B.2.
Each national RA shall assign a subsequent OID to a national organization which requests one. The national RA shall follow a process similar to what is described in Rec. ITU-T X.1500.1, clauses 7 to 10 (in particular, it plays both the technical role and the administrative role).
Each national RA shall make best efforts to provide a publicly available Web page detailing entries in the register, with email addresses protected against robot harvesting.
It is recommended that each national organization assigns subsequent OIDs (of its OID) as depicted on Rec. ITU-T X.1500.1, Figure B.1.