RFC 2350 - OpenDFIR CSIRT Version: 2.0 Date: Sun, 13 Sep 2026 Author: Marc-Frederic GOMEZ 1. DOCUMENT INFORMATION This document contains a description of OpenDFIR CSIRT according to RFC 2350. It provides basic information about the team, the ways it can be contacted, its responsibilities and the services it offers. 1.1 Date of Last Update Version 2.0, published 13 September 2026. This version supersedes version 1.2 of 13 September 2018, published under the former name of the association. 1.2 Distribution List for Notifications There is no distribution list for notifications of changes to this document. Changes are published at the locations listed in 1.3. 1.3 Locations where this Document May Be Found The current version of this document is available at: https://www.opendfir.org/en/about/rfc2350/ https://www.opendfir.org/rfc2350.txt 1.4 Authenticating this Document The plain text version of this document is signed with the team key described in section 2.8. The detached signature is available at: https://www.opendfir.org/rfc2350.txt.asc 2. CONTACT INFORMATION 2.1 Name of the Team OpenDFIR CSIRT Computer Security Incident Response Team of OpenDFIR. 2.2 Address OpenDFIR OpenDFIR CSIRT - Attn. Marc-Frederic GOMEZ 21 rue Saint Maurice 36600 Valencay France 2.3 Time Zone Central European Time (CET, GMT+0100), Central European Summer Time (CEST, GMT+0200) from the last Sunday in March to the last Sunday in October. 2.4 Telephone Number None. The team is contacted by electronic mail. 2.5 Facsimile Number None. 2.6 Other Telecommunication None. 2.7 Electronic Mail Address Incident reports and vulnerability reports: csirt(at)opendfir.org Non-incident related mail: contact(at)opendfir.org 2.8 Public Keys and Other Encryption Information Team key for csirt(at)opendfir.org Key ID : 0x96DFA36A713668A0 Fingerprint : CE34 5FB2 800F 52EB 7117 0CBF 96DF A36A 7136 68A0 Algorithm : EdDSA ed25519 (signing), ECDH cv25519 (encryption subkey) Created : 13 September 2026 Expiry : none The public key is available at: https://www.opendfir.org/csirt-opendfir.asc Correspondents are asked to encrypt sensitive material sent to the team with this key. The team signs its own advisories and reports with the same key. 2.9 Team Members The team leader of OpenDFIR CSIRT is Marc-Frederic Gomez. A deputy team representative is designated for continuity purposes. Other team members are not listed publicly. 2.10 Other Information General information about OpenDFIR is available at: https://www.opendfir.org/en/ 2.11 Points of Customer Contact The preferred method for contacting OpenDFIR CSIRT is electronic mail to csirt(at)opendfir.org. Messages sent to this address are handled by the team on duty. Hours of operation: Monday to Friday, 06:00 to 20:00 CET or CEST. Outside these hours, messages are queued and handled on the next working day. The team does not operate an out-of-hours service. If the matter is not urgent, please send electronic mail. If no response has been received within the time stated in section 5.1, please contact the team again. 3. CHARTER 3.1 Mission Statement The purpose of OpenDFIR CSIRT is to coordinate incident response for information security incidents affecting its constituency, and to publish vulnerability advisories, threat intelligence analysis and digital forensics methods as open material available to all. 3.2 Constituency The constituency of OpenDFIR CSIRT consists of the organisations registered with the team. Membership of the constituency results from registration, not from a sector of activity, a geographical location or an address range. Registration is currently by invitation of the association. There is no open registration procedure. Any change to this arrangement is announced at: https://www.opendfir.org/en/services/constituency/ The technical scope covered for a registered organisation is limited to the systems, domain names and address ranges declared by that organisation at registration and kept up to date by it. No direct support is given to end users. End users are expected to contact their own CSIRT, their information security officer, their internet service provider or their system administrator. OpenDFIR CSIRT supports the latter. Publications issued by OpenDFIR are public and available to all, without registration. Registration conditions access to incident handling services only. 3.3 Sponsorship and/or Affiliation OpenDFIR CSIRT is operated by OpenDFIR, a non-profit association governed by the French law of 1 July 1901, registered under number W782005220. Funding is provided by donations and by audit work carried out for third parties. OpenDFIR CSIRT is independent of any vendor, of any employer of its members and of any public authority. Its publications commit OpenDFIR alone. 3.4 Authority OpenDFIR CSIRT coordinates incident response within its constituency. It advises its constituents and has no authority to require any action from them. It acts only at the invitation of the organisation concerned and does not substitute itself for any national authority. 4. POLICIES 4.1 Types of Incidents and Level of Support OpenDFIR CSIRT addresses information security incidents which occur, or threaten to occur, within its constituency as described in 3.2. The level of support given varies with the type and severity of the incident, the size of the community affected, and the resources available to the team at the time. The team is staffed by volunteers and gives an undertaking of means, not of result. OpenDFIR CSIRT does not carry out remediation, penetration testing, security auditing on demand or consultancy work. These activities are outside the scope of the team. No action is taken on any system without a written mandate from the person responsible for the organisation concerned. 4.2 Co-operation, Interaction and Disclosure of Information OpenDFIR CSIRT co-operates with other teams in the field of information security. This co-operation includes the exchange of information regarding incidents and vulnerabilities. The team protects the privacy of reporters, partners and constituents. Information is passed on in anonymised form unless the reporting party has agreed otherwise. All information submitted to OpenDFIR CSIRT is treated as confidential by default. It is forwarded to concerned parties only where this is necessary to resolve a specific incident, and where consent is given or implicit. Information is marked in accordance with the Traffic Light Protocol version 2.0 published by FIRST. Correspondents are asked to mark their own submissions accordingly. OpenDFIR CSIRT operates under French law. This involves the handling of personal data in accordance with the General Data Protection Regulation and with French data protection law. The team may be required to disclose information pursuant to a court order. 4.3 Communication and Authentication For routine communication not containing sensitive information, conventional unencrypted electronic mail may be used. For sensitive information, PGP-encrypted electronic mail is used. The team key is described in section 2.8. Where a correspondent must be authenticated before communication, this is done through existing webs of trust such as FIRST or Trusted Introducer, or by call-back, mail-back or a face-to-face meeting. 5. SERVICES 5.1 Incident Response OpenDFIR CSIRT assists the technical contacts of its constituency in handling the technical and organisational aspects of incidents. 5.1.1 Incident Triage - determining whether a report describes an authentic incident - assessing and prioritising the incident - assisting with the preservation of evidence 5.1.2 Incident Co-ordination - determining the organisations involved - contacting those organisations - facilitating contact with parties able to help resolve the incident - forwarding reports to other CSIRT teams, with the agreement of the reporting organisation 5.1.3 Incident Resolution - advising the local technical contacts on appropriate action - following up on the progress made - reporting back to the organisation concerned OpenDFIR CSIRT aims to respond to an incident report submitted by a person within two working days. Given current staffing levels this cannot be guaranteed. If no response has been received after four working days, please contact the team again. Automatically generated reports and data feeds are processed as automatically as possible. 5.2 Proactive Activities OpenDFIR CSIRT: - publishes vulnerability advisories on vulnerabilities for which exploitation is confirmed, corroborated across several sources - publishes threat intelligence analysis based exclusively on open sources - publishes digital forensics methods and anonymised reports for Windows, Linux and macOS systems - maintains contact information for the technical contacts of its constituency - conducts awareness and training activities All publications are issued under an open licence and are available without registration at: https://www.opendfir.org/en/publications/ 6. INCIDENT REPORTING FORMS There are no local forms available. Incident reports are submitted by electronic mail to csirt(at)opendfir.org. Reporters are asked to provide, as far as they are able: - the organisation concerned and a named point of contact - the date, time and time zone of the events reported - the systems and addresses concerned - a description of the observed facts - any relevant log extracts or artefacts, compressed and encrypted with the team key - the Traffic Light Protocol marking applying to the submission 7. DISCLAIMERS While every precaution is taken in the preparation of information, notifications and advisories, OpenDFIR CSIRT assumes no responsibility for errors or omissions, nor for any damage resulting from the use of the information it publishes. Services described in this document are provided as an undertaking of means. They do not constitute a contractual commitment unless a separate written agreement states otherwise. TLP:CLEAR