RFC2350 - PRIO

1. Information about the document

This document describes PRIO's incident response coordination service in accordance with RFC 2350.

Our Mission:

To produce and supply energy to move people, ideas, vehicles and goods.
Innovative, accessible and secure energy.
Energy to grow and create value.
For everyone.

Our Vision:

PRIO's vision is to lead the accessible energy transition in Portugal by being the country's largest producer of biofuels from waste raw materials.

1.1 Date of Last Update

Version 1.0 published on 19/02/2025.

1.2 Distribution Lists for Notifications

There is no distribution channel for notifying changes to this document.

1.3 Access to this document

The updated version of this document is available at https://www.prio.pt/en/csirt

1.4 Authenticity of this Document
This document was produced by CSIRT PRIO.

2. Contact Information

2.1 team name

CSIRT PRIO

2.2 Postal address

PRIO
Terminal de Granéis Líquidos
Lote B — Porto de Aveiro
3834-908 Gafanha da Nazaré

Portugal

2.3 time zone

Portugal/WEST (GMT+0, GMT+1 in daylight saving time)

2.4 Telephone

+351 234 390 010 - Contact during normal opening hours (09h00 - 18h00)

+351 234 493 100 - Emergency contact (24x7)

2.5 Other Telecommunications

Não existentes.

2.6 Email addresses

Email address for incident notification:
csirt@prio.pt

Email for other matters relating to PRIO services:
apoiocliente@prio.pt

2.7 Public Keys and Cipher Information

None.

2.8 team members

Confidential.

2.9 other information

More information about the PRIO CSIRT can be found at https://www.prio.pt/en/csirt

2.10 Means of Contact for Users

CSIRT PRIO has the means of contact listed in 2.4 to 2.6.

3. Guidelines

3.1 Mission

The PRIO CSIRT acts for its internal community and its clients in the context of responding to information security incidents, with the aim of protecting its services and related personal information, as well as preventing possible attacks that could affect its services and its business.

3.2 Community Served

CSIRT PRIO acts for its employees and stakeholders, collaborating in the information security incident response process with other involved and necessary internal entities or service providers.

CSIRT PRIO is responsible for monitoring and coordinating incident response in the context of the following IP addresses:
prio.pt, 193.126.246.48/28
myprio.com, 178.166.64.80/28

3.3 Affiliation

The PRIO CSIRT is a PRIO team.

3.4 Authority

CSIRT PRIO acts under the authority of the Security Officer.

4. Policies

4.1 Types of incidents and level of support

The PRIO CSIRT responds to all types of cybersecurity incidents, namely those that result in a security breach of the following types:

Abusive Content;

Malicious Code;

Information gathering;

Intrusion Attempt;

Intrusion;

Availability;

Information Security;

Fraud;

Vulnerability.

The level of support provided for each incident can vary not only based on the severity of the incident, but also on the resources available. However, all incidents are dealt with as quickly as possible by CSIRT PRIO.

4.2 Co-operation, Interaction and Privacy Policy

Internal policies stipulate that sensitive information may be passed on to third parties, solely and exclusively in case of need and with the prior express authorisation of the individual or entity to whom the information relates.

4.3 Communication and Authentication

Of the means of communication made available by CSIRT PRIO, telephone and unencrypted e-mail are considered sufficient for the transmission of information.

5. Services

5.1 Incident Response

The PRIO CSIRT provides a coordination and response service for cybersecurity incidents related to the entire PRIO community, always respecting industry best practices.

5.2 Incident triage

The PRIO CSIRT carries out an initial analysis of the incident in order to confirm its veracity and classify it.

5.3 Incident Analysis
CSIRT PRIO carries out an analysis to determine the root cause of the incident. If necessary, contacts are made with other internal or external organisations.

5.4 Incident resolution

CSIRT PRIO defines and applies eradication and/or mitigation measures related to the incident.

5.5 Incident monitoring

CSIRT PRIO ensures the monitoring, correlation and analysis of internal and external sources.

5.6 Proactive activities

CSIRT PRIO constantly monitors possible threats that may arise and proactively alerts the community and other stakeholders previously defined for this purpose.

5.7 Post-Mortem report
CSIRT PRIO draws up a response and analysis report with all the details of the incident, following the defined template(s). This report should indicate the life cycle of the incident, the measures taken in each of its phases, the people involved, among other details.