========================================================================= RFC 2350 - A3Sec Grupo - CSVD CSIRT Description for A3SEC ========================================================================= 1. Document Information This document contains a description of A3SEC in accordance with RFC 2350. It provides basic information about the team, the ways it can be contacted, its responsibilities and the services it offers. 1.1 Date of Last Update Version 1.0 - 2026-10-23. 1.2 Distribution List for Notifications There is no public distribution list for notifications regarding changes to this document. Changes are published at the location listed in section 1.3. Questions about updates may be directed to the team e-mail address (see section 2.7). 1.3 Locations where this Document May Be Found The current version of this document is available at: https://www.a3sec.com/rfc2350.txt It is also registered in the Trusted Introducer (TF-CSIRT) directory at https://www.trusted-introducer.org/. 1.4 Authenticating this Document This document has been signed with the A3SEC team PGP key. The signature and the team key are available as described in section 2.8. 2. Contact Information 2.1 Name of the Team "A3SEC" - A3Sec Grupo - CSVD (Centro de Seguridad y Vigilancia Digital). 2.2 Address A3Sec Calle de Aravaca, 6 28040 Madrid Spain 2.3 Time Zone Europe/Madrid (CET / CEST - UTC+1, UTC+2 in summer). 2.4 Telephone Number +34 628 079 354 (team representative, business hours and on-call) 2.5 Facsimile Number None. 2.6 Other Telecommunication None. 2.7 Electronic Mail Address soc_es@a3sec.com This mailbox is monitored by the team on a 24x7 basis and is the preferred point of contact for incident reporting. 2.8 Public Keys and Other Encryption Information The A3SEC team uses a dedicated team PGP key for signed and encrypted communication: User ID : A3SEC Team Key ID : 0x26C4DC128D347413 Fingerprint: 992B 5D82 58F6 A047 4B3B 4125 26C4 DC12 8D34 7413 The team key can be retrieved from the usual public key servers and is also registered within the Trusted Introducer directory. The personal keys of the team representatives are registered within the Trusted Introducer directory. 2.9 Team Members The team representatives are: Joaquin Gutierrez Garcia-Arias (primary representative) Alejandro Agudelo-Salazar (secondary representative) The full list of team members is not published. Management, liaison and supervision are provided by A3Sec. 2.10 Other Information General information about A3Sec is available at https://www.a3sec.com/. 2.11 Points of Customer Contact The preferred method for contacting the team is via e-mail at soc_es@a3sec.com. For sensitive information, please use the team PGP key (section 2.8). If it is not possible or advisable to use e-mail, the team can be reached by telephone during business hours (section 2.4). The team's hours of operation are 24x7. 3. Charter 3.1 Mission Statement The purpose of A3SEC is to provide managed detection, monitoring and incident response services to the customers of A3Sec, coordinating the handling of security incidents affecting their assets and acting as a trusted point of contact with the wider CSIRT community. 3.2 Constituency The constituency of A3SEC is the customer base of A3Sec's managed security services (commercial SOC/CSIRT), mainly in Spain and Latin America. Customer network ranges, ASNs and domains are contractually confidential and change over time, and are therefore not listed here. Constituency type: Service Provider Customer Base / Commercial Organisation. 3.3 Sponsorship and/or Affiliation A3SEC is operated by and funded by A3Sec. The team maintains working relationships with other CSIRT teams and participates in the Spanish CSIRT community. 3.4 Authority A3SEC operates with the authority delegated by A3Sec and acts on behalf of its constituency under the terms of the corresponding managed-service contracts. A3SEC coordinates incidents affecting its constituency but does not have authority over constituents' own decisions regarding remediation. 4. Policies 4.1 Types of Incidents and Level of Support A3SEC addresses all types of computer security incidents which occur, or threaten to occur, within its constituency. The level of support given depends on the type and severity of the incident, the type of constituent affected, the size of the affected community and the terms of the applicable service agreement. Incidents are prioritised according to their apparent severity and impact. 4.2 Co-operation, Interaction and Disclosure of Information A3SEC co-operates with other teams and organisations on a need- to-know basis and acts in accordance with the Traffic Light Protocol (TLP). Information received marked with a TLP level will be handled according to that marking. All sensitive information (including constituent data, system configurations and vulnerabilities) is treated as confidential and is only shared with the explicit consent of the party concerned, unless disclosure is required by law. 4.3 Communication and Authentication For normal communication not containing sensitive information, A3SEC will use conventional methods such as unencrypted e-mail. For secure communication, PGP-encrypted and/or signed e-mail will be used (section 2.8). Where telephone is used, the identity of the counterpart may be verified through previously exchanged trusted channels. 5. Services 5.1 Incident Response A3SEC assists its constituency in handling the technical and organisational aspects of incidents. In particular, it provides assistance or advice with respect to the following aspects of incident management: 5.1.1 Incident Triage - Determining whether an incident is genuine. - Assessing and prioritising the incident. 5.1.2 Incident Coordination - Determining the involved parties. - Facilitating contact with those parties. - Reporting to the affected constituents. - Coordinating with other CSIRTs where appropriate. 5.1.3 Incident Resolution - Advising on remediation and recovery steps. - Following up and collecting evidence as required. - Lessons learned and post-incident reporting. 5.2 Proactive Activities A3SEC also provides proactive services to its constituency, including security monitoring (SOC), threat intelligence (CTI), vulnerability and exposure monitoring, detection engineering and security awareness support. 6. Incident Reporting Forms There are no specific local forms for reporting incidents to A3SEC. Incidents can be reported by e-mail to soc_es@a3sec.com. Please provide at least: contact details, affected systems, a description of the incident, timestamps (with time zone) and any relevant evidence. 7. Disclaimers While every precaution is taken in the preparation of information, notifications and alerts, A3SEC assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. =========================================================================