diff --git a/groups/restrictions.yaml b/groups/restrictions.yaml
index 7cc66cb95598..1ee8afe1d46d 100644
--- a/groups/restrictions.yaml
+++ b/groups/restrictions.yaml
@@ -115,6 +115,9 @@ restrictions:
       - "^k8s-infra-rbac-elekto@kubernetes.io$"
       - "^k8s-infra-rbac-slack-infra@kubernetes.io$"
       - "^k8s-infra-staging-slack-infra@kubernetes.io$"
+  - path: "sig-etcd/groups.yaml"
+    allowedGroups:
+      - "^etcd-security@kubernetes.io$"
   - path: "sig-docs/groups.yaml"
     allowedGroups:
       - "^blog@kubernetes.io$"
diff --git a/groups/sig-etcd/OWNERS b/groups/sig-etcd/OWNERS
new file mode 100644
index 000000000000..7d089be99179
--- /dev/null
+++ b/groups/sig-etcd/OWNERS
@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- sig-etcd-leads
+reviewers:
+- sig-etcd-leads
+
+labels:
+- sig/etcd
diff --git a/groups/sig-etcd/groups.yaml b/groups/sig-etcd/groups.yaml
new file mode 100644
index 000000000000..7832d2d4900b
--- /dev/null
+++ b/groups/sig-etcd/groups.yaml
@@ -0,0 +1,15 @@
+groups:
+  - email-id: etcd-security@kubernetes.io
+    name: sig-security
+    description: |-
+      Private list for non-public (internal) triage of etcd security vulnerabilities
+      reported by any etcd contributors or users.
+    settings:
+      WhoCanPostMessage: "ANYONE_CAN_POST"
+      ReconcileMembers: "true"
+    owners:
+      - benjamin.ahrtr@gmail.com
+      - jablair@redhat.com
+      - siarkowicz@google.com
+      - spzala@us.ibm.com
+      - wenjiazhang@google.com