-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CSIRT Description for ASSECO.CLOUD ================================ 1. About this document This document contains a description of ASSECO.CLOUD according to RFC 2350. It provides basic information about the CERT, the ways it can be contacted, describes its responsibilities and the services offered. 1.1 Date of Last Update This is version 2.0, published at 2025-10-29. 1.2 Distribution List for Notifications Notifications of updates are submitted to Trusted Introducer by e-mail: . 1.3 Locations where this Document May Be Found The current version of this CSIRT description document is available from ASSECO.CLOUD website at: https://www.asseco.cloud/RFC2350.txt Please make sure you are using the latest version. 1.4 Authenticating this Document This document has been signed with GPG key and its authenticity can be verified with ASSECO.CLOUD GPG key as published in 2.8. 2. Contact Information 2.1 Name of the Team ASSECO.CLOUD 2.2 Address Asseco Cloud Sp. z o.o. 21 Krolowej Korony Polskiej Street 70-486 Szczecin Poland 2.3 Time Zone Central European Time (CET) - UTC+1 Central European Summer Time (CEST) - UTC+2 according to EU regulations (from the last Sunday of March to the last Sunday of October) 2.4 Telephone Number +48 58 765 98 55 2.5 Facsimile Number None available. 2.6 Other Telecommunication None available. 2.7 Electronic Mail Address cert@asseco.cloud 2.8 Public Keys and Other Encryption Information ASSECO.CLOUD uses the GPG key: User ID: CERT ACL Key ID: 0xA241829E Key type: RSA Key size: 4096 Expires: 10.01.2027 Fingerprint: ABBE115A8A3BFA2FCFF936EA9DE709EBA241829E This key can be received directly from our website: https://www.asseco.cloud/CERT_ACL_0xA241829E_public.txt 2.9 Other Information General information about ASSECO.CLOUD can be found at https://www.asseco.cloud/ 2.10 Points of Customer Contact ASSECO.CLOUD prefers to receive incident reports via e-mail. Please use our cryptographic keys above to ensure integrity and confidentiality. ASSECO.CLOUD's hours of operation are generally restricted to regular business hours (09:00-17:00 Monday to Friday except holidays). 3. Charter 3.1 Mission Statement Taking actions to minimize the probability of occurrence of cyber security incidents, as well as minimizing the effect of their occurrence in scope of the provided services. Customer support in the identifying and mitigating the cyber threats. 3.2 Constituency Our constituency consists of entities from the Asseco Group - who signed an agreement to use our incident management services. We continuously update our constituency according to the ASN, IP or domain data provided to us by our Customers. 3.3 Sponsorship and/or Affiliation ASSECO.CLOUD is a private entity and part of Asseco Group. 3.4 Authority ASSECO.CLOUD handles and coordinates incidents on behalf of its Customers and is bound by contractual terms. 4. Policies 4.1 Types of Incidents and Level of Support All incidents are by default normal priority unless contractual arrangements prioritize them otherwise. Incidents handled as the contribution to the Society are therefore treated as normal priority regardless of the label attached to incident notification. It is ASSECO.CLOUD's authority to decide whether increasing the priority to emergency is appropriate. 4.2 Co-operation, Interaction and Disclosure of Information ASSECO.CLOUD declares that all information related to incidents handled is considered Confidential. Information evident to be sensitive or that may be harmful is handled only in a secure environment and encrypted in storage and in transit. When reporting an incident and providing sensitive information, please use encryption or contact ASSECO.CLOUD to arrange different channel of secure communication. ASSECO.CLOUD declares full support for the Information Sharing Traffic Light Protocol (https://www.trusted-introducer.org/ISTLPv11.pdf). Information sent in and labelled according to ISTLP will be handled appropriately. Information submitted to ASSECO.CLOUD may be distributed on a need-to-know basis to trusted parties (such as ISPs, other CERT teams) for the sole purpose of incident handling. ASSECO.CLOUD does not report incidents to the Law Enforcement Agencies unless required by the national law. ASSECO.CLOUD cooperates with the LEAs only in the course of an official investigation or when instructed by a constituent to cooperate. 4.3 Communication and Authentication ASSECO.CLOUD uses GPG encryption to ensure the confidentiality and integrity of communication. All sensitive information sent in should be encrypted. Messages regarding incidents are sent by ASSECO.CLOUD staff signed with our main GPG key (see 2.8) and encrypted when containing a sensitive information. ASSECO.CLOUD reserves the right to verify the authenticity of information or its source to the extent allowed by the law. 5. Services 5.1 Incident Response ASSECO.CLOUD will assist organizations in handling of security incidents. ASSECO.CLOUD's capabilities cover the full cycle of incident response - Preparation, - Detection and Analysis, - Containment, Eradication and Recovery, - Lessons learned, Collected evidence analysis and Recommendation. 5.2 Proactive Activities ASSECO.CLOUD makes an efforts to enhance constituents immunity to security incidents and to limit the impact of incidents that occur and increase Customer's awareness. 6. Incident Reporting Forms There are no specific forms developed for reporting incidents to ASSECO.CLOUD. 7. Disclaimers While every precaution will be taken in the preparation of information, notifications and alerts, ASSECO.CLOUD assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within. -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEq74RWoo7+i/P+TbqnecJ66JBgp4FAmkB8yMACgkQnecJ66JB gp4x7A/9HHx79rrmNHMHJx6Nu9C8E7n8S5r3UMiSozAtsXhU9hgP5i+4YDiWAE8g +04mtxkCvUiRcuPuwAeJkFAdbORZdjO2lxcTbJuT37YXxmZjhh1MZbcyTMpEd3nz DYkdWRlKL/pb8Y8fisZ/9UBr6FLlBoyL5c4BLsoYr77g12ufAvcHLJVI5o58Hrjz iOCiO0gH3KlbksbokzMpMuJ5MK+x+TJkzm7ZlvEklnDm01jhqrKZKvNTUTQtXNwX 1NZC2Zfi3DukTN0gnPCiowxcIvcW/ATGwujTlEObE/H6rXrIs5F3Ww0b9lXARmT3 uyBNMdp74EgTDa1n3pDD/tZXB//8qiV0+XcVorKu3c4GjXvb6vmsTd1ItRK+lgYD wHdQq4vdq3hTo9fkWRoqCuf+EVr4A7mVpOg+bw3BKfMjRlOFcgo0ZWrr+9md+6Hv 4VXTFkF4Pb7cxRz4a0Kwh9ZpgPce0KQ73NqOtk4MdU48KnrLKbOVKT5KtgFPxxbT PR1z6CFbdUEBt0LE34R7JJ11JPGr1RTltF1l4GnZaolRKs+Kk4kgYaOgJYfDS6hw JjFKacMx8RslTs+CPIYGpm0B8ISre1S7BXUfU4dCXdlMOXex5HG7WBJx1rCpF7CQ 8ztwkK6kBxCWwaSlwfAIRQzLDMHiB2xU2iDbs4w3yzatHccx4co= =oMKO -----END PGP SIGNATURE-----