1. About this document The document provides information on xSOC TraffordIT response to and handling of computer security incidents in an RFC 2350 compliant format. 1.1 Date of Last Update This is version 5.0 released 22.09.2025 1.2 Distribution List for Notifications Currently, xSOC TraffordIT does not use any distribution lists to notify of changes to this document. 1.3 Locations where this Document May Be Found The applicable version of "RFC 2350 for xSOC Trafford" is available at the following URL: https://traffordit.pl/wp-content/uploads/2023/10/RFC2350_ENG.txt 1.4 Authenticating this Document This document was signed using a PGP key and confirms its authenticity Authenticity can be verified using the PGP key published in section 2.8 2. Contact Information 2.1 Name of the Team xSOC Trafford 2.2 Address Trafford IT spółka Z.O.O spółka komandytowa. xSOC, ul. Taneczna 18 02-829 Warszawa 2.3 Time Zone Central European Time (CET) - UTC+1 Central European Summer Time (CEST) - UTC+2 according to EU regulations (from the last Sunday of March to the last Sunday of October) 2.4 Telephone Number +48 22 274 17 06 2.5 Fax Number Not applicable. 2.6 Other Telecommunication Not applicable. 2.7 Electronic Mail Address The address is used to contact the team soc@traffordit.pl 2.8 Public Keys and Other Encryption Information User ID: xSOC Trafford Key ID: 18C8 2CDA CFFC 670B Key type: RSA Key size: 4096 Fingerprint: 2905 11AD EF2F 4DC9 13A3 8849 18C8 2CDA CFFC 670B 2.9 Other Information The xSOC Trafford team consists of two areas: Managed Detection And Response (MDR) and Advanced Security Operation (ASO), within which there are security engineers with practical, many years of experience and competences in the field of IT and IT security, confirmed by a number of industry certificates in the areas of incident response and implementation, maintenance and development of IT systems ensuring IT security. 2.10 Points of Customer Contact Trafford IT was established in 2012. From the beginning of its activity, Trafford IT has specialized in providing IT security technologies. The company consists of experts in the areas of incident response and specialists with many years of experience in implementing and maintaining IT systems ensuring IT security in both local organizations and international corporations. 2.11 Additional contact information The preferred method of contacting xSOC is by email to soc@traffordit.pl. All emails sent to this address are forwarded to the responsible analyst on duty. In addition, the following email aliases have been added for communication with the xSOC team: - cert@traffordit.pl - security@traffordit.pl - abuse@traffordit.pl All emails sent to this address are forwarded to the analyst on duty. xSOC working hours depend on the signed contract with the client, they are normally limited to fixed working hours (07:00-19:00 from Monday to Friday, except holidays), however, contracts may include 24/7/365 operation. 3. Charter Building competences and skills of our clients in monitoring, detecting and responding to security incidents. Supporting our clients in the fight against cyber threats. 3.1 Mission Statement The mission of xSCO Trafford is to increase the level of cybersecurity among TraffordIT spółka Z.O.O spółka komandytowa 3.2 Constituency The area of operation of xSOC Trafford includes private and public clients with whom TraffordIT spółka z ograniczoną odpowiedzialnością spółka komandytowa has signed an agreement in the field of Managed Detection And Response (MDR) and Advanced Security Operation (ASO) in the areas of support in responding to computer security incidents. 3.3 Sponsorship and/or Affiliation xSOC Trafford functions within TraffordIT Sp. Z.O.O spółka komandytowa 3.4 Authority xSOC Trafford operates under the management and authorization of the Management Board of TraffordIT Sp. Z.O.O spółka komandytowa, based on contracts concluded with clients. 4. Policies 4.1 Types of Incidents and Level of Support The level of support provided by xSOC Trafford depends on the type of signed and provided contract in the field of Managed Detection And Response (MDR) or Advanced Security Operation (ASO) in the areas of monitoring, detection and response to computer security incidents and advanced services described in point 5 of the Service. The level of support provided by xSOC may include, in addition to the type of service provided, information about the type, severity and scope of the event. The importance of events is determined on the basis of agreements concluded with clients. 4.2 Co-operation, Interaction and Disclosure of Information Information related to event handling is treated as confidential and is secured under agreements and documents on confidentiality of information concluded between TraffordIT Sp. Z.O.O spółka komandytowa and clients. Sensitive or potentially harmful information is handled in a secure environment and encrypted during storage and transit. xSOC declares full support and compatibility with the Traffic Light Protocol (https://www.first.org/tlp/). Information is sent and marked in accordance with TLP rules. 4.3 Communication and Authentication xSOC Trafford secures the acquired information in accordance with the relevant legal provisions and internal regulations regarding the classification of information (including those resulting from the ISMS according to ISO 27001). To guarantee the confidentiality and integrity of communications, xSOC recommends using PGP encryption (described in section 2.8). All sensitive information transmitted should be encrypted. 5. Services xSOC Trafford provides services: 1. MDR (Managed Detection And Response) in the field of management and response to IT security threats. - Detection and response to events and incidents – (Managed Detection and Response) 2. Advanced Security Operation (ASO), i.e. advanced services in the field of detecting and responding to security incidents, including: - Analysis and exchange of information about threats (Threat Intelligence) - Advanced analysis of security incidents, including post-intrusion analysis - Proactive Threat Hunting - Analysis of the environment and architecture in the area of Incident Response - Security validation in the process, tool and human resources layers in the field of incident response 3. Additional services - Reverse Engineering - Assessment and verification of maturity of monitoring and response teams (SOC/CSIRT/CERT) 5.1 Incident Response xSOC Trafford response to incidents consists of four steps: - Preparation in case of an incident, - Identification and analysis of incidents, - Mitigation, elimination and recovery from incidents, - Post-incident actions. 5.2 Proactive actions The proactive activities undertaken by xSOC Trafford include the following: - Building users' cybersecurity awareness, - Threat Intelligence, Threat Landscape activities - Implementation of security solutions, - Maintaining and developing security solutions, 6 Incident reporting forms No incident reporting forms for xSOC Trafford have been developed. Incident reports can be sent to soc@traffordit.pl. We recommend using a PGP key (described in section 2.8) to encrypt any private or confidential information. When contacting xSOC Trafford, please provide the following information: - Contact details of the person/organization (name and surname, function, e-mail, telephone number), - Brief information about the event, - Details about the incident - what systems were affected, log fragments, - Observed impact of the incident on the organization's operations, - Additional information collected and actions taken so far. 7. Disclaimers Although every precaution is taken in preparing information, notices and warnings, xSOC Trafford is not responsible for errors or omissions or for damages resulting from the use of the information contained therein.