Public Content
Version 1.0, approved and published on May 29, 2026.
This document describes the public information of CSIRT-BIGSECURE, including its contact details, community served, scope, authority, general policies and services related to cybersecurity incident management.
Changes to this document are not distributed through a public mailing list. Any inquiry, comment or request related to this document must be sent to the official CSIRT-BIGSECURE contact email address:
Relevant updates to this document will be published at the official location defined by BIGSECURE S.A.C.
The current version of this document will be available at the following official link:
http://www.bigsecure.net/csirt/rfc2350-en.html
If differences exist between versions, the version officially published and approved by BIGSECURE S.A.C. shall prevail.
CSIRT-BIGSECURE
BIGSECURE S.A.C. Computer Security Incident Response Team.
CSIRT-BIGSECURE is formalized as a specialized unit within BIGSECURE S.A.C., supported by the existing capabilities of the Security Operations Center, the Information Security Management System based on ISO/IEC 27001:2022, the Integrated Management System processes, the cybersecurity technical team and the monitoring, response, vulnerability management and threat intelligence services.
GMT –5 (Lima, Peru)
The main channel for reporting cybersecurity incidents is the official CSIRT-BIGSECURE email address.
The preferred method for contacting CSIRT-BIGSECURE is email.
To report critical incidents or high-urgency situations, the word [URGENTE] must be placed at the beginning of the email subject line in order to facilitate prioritization and escalation.
Subject example:
[URGENTE] Cybersecurity incident report - [Client name]
For sensitive communications or the exchange of confidential information related to cybersecurity incidents, CSIRT-BIGSECURE may use secure communication mechanisms approved by BIGSECURE S.A.C.
As of the publication date of this version, CSIRT-BIGSECURE does not have a published PGP public key. The generation, validation and publication of the PGP public key will be managed as part of the progressive strengthening process of the team's secure communication capabilities.
Once generated, the PGP public key associated with csirt@bigsecure.net will be published at the official CSIRT-BIGSECURE location and/or incorporated into an updated version of this document.
-----BEGIN PGP PUBLIC KEY BLOCK----- [PENDING GENERATION AND PUBLICATION] -----END PGP PUBLIC KEY BLOCK-----
The associated private key will not be shared under any circumstances and must be safeguarded in accordance with BIGSECURE S.A.C.'s internal information security guidelines.
The complete list of CSIRT-BIGSECURE members is not publicly available due to operational security and information protection reasons.
Team members will identify themselves to the reporting party through official channels during the handling of an incident, in accordance with the contractual scope, internal procedures and the criticality of the case.
General information about CSIRT-BIGSECURE may be found on the official portal:
http://www.bigsecure.net/csirt
Specific information about relevant updates, contact channels and applicable public documents will be published by BIGSECURE S.A.C. through the corresponding official media.
The preferred method for contacting CSIRT-BIGSECURE in the event of cybersecurity incidents is to send an email to:
The message will be reviewed by the responsible team or referred to the corresponding backup personnel, depending on the criticality of the case, the contractual scope of the service, applicable service level agreements and BIGSECURE S.A.C.'s internal procedures.
For critical incidents or high-urgency situations, the word [URGENTE] must be placed at the beginning of the email subject line in order to facilitate prioritization and escalation.
CSIRT-BIGSECURE incident response services are available 24x7.
Incident handling, triage, escalation and coordination will be performed in accordance with the scope of the services contracted by each client, the applicable service level agreements, the criticality of the incident and BIGSECURE S.A.C.'s internal procedures.
For general inquiries, document coordination or non-critical requests, CSIRT-BIGSECURE may prioritize handling according to the team's operational availability and the established channels.
The mission of CSIRT-BIGSECURE is to coordinate, analyze, manage and support the response to cybersecurity incidents affecting clients served by BIGSECURE S.A.C., as well as internal assets, services and processes linked to the scope of the Information Security Management System, when applicable.
CSIRT-BIGSECURE focuses its activities on strengthening the protection of the confidentiality, integrity and availability of information through the detection, analysis, containment, escalation, monitoring and continuous improvement of cybersecurity incidents, supported by the existing capabilities of the Security Operations Center —SOC—, the Integrated Management System, the cybersecurity technical team and the monitoring, response, vulnerability management and threat intelligence services.
The vision of CSIRT-BIGSECURE is to consolidate itself as a specialized cybersecurity incident response unit recognized for its technical capability, timely handling, traceability, collaboration and alignment with international good practices.
CSIRT-BIGSECURE seeks to progressively strengthen its operational, documentary and cooperation capabilities, with the objective of contributing to its clients' digital trust, actively participating in cybersecurity technical communities and supporting coordinated incident management at local, regional and international levels.
The community served by CSIRT-BIGSECURE is mainly composed of BIGSECURE S.A.C. clients who receive cybersecurity, monitoring, incident management, technical support, vulnerability management, threat intelligence or other services related to information protection and operational continuity.
Likewise, CSIRT-BIGSECURE may also provide support, coordination or recommendations regarding incidents affecting BIGSECURE S.A.C.'s internal assets, services or processes, provided that these are linked to the scope of the Information Security Management System or may impact the delivery of services to clients.
Incident handling will be performed in accordance with the contractual scope of the services contracted by each client, applicable service level agreements, incident criticality, the authority defined for intervention and BIGSECURE S.A.C.'s internal procedures.
CSIRT-BIGSECURE may also collaborate, when appropriate, with other incident response teams, CERTs, CSIRTs, technology providers, competent authorities, technical communities and national or international organizations, while respecting applicable confidentiality, data protection, information security and contractual restrictions.
CSIRT-BIGSECURE is sponsored by BIGSECURE S.A.C. and is formalized as a specialized unit within its organizational structure, with support from Senior Management, the Information Security Area, the Security Operations Center —SOC—, the Integrated Management System and the corresponding technical and support areas.
CSIRT-BIGSECURE is authorized to handle, coordinate and support the management of cybersecurity incidents related to the services provided by BIGSECURE S.A.C. to its clients, in accordance with the contractual scope, internal procedures, service level agreements and the authority defined for each case.
CSIRT-BIGSECURE aims to strengthen its participation in technical communities, cooperation networks and national and international spaces related to incident response, vulnerability management, threat intelligence and cybersecurity good practices.
The formal participation or affiliation of CSIRT-BIGSECURE in international communities, including FIRST or similar organizations, will be subject to compliance with applicable requirements, corresponding approval and formal acceptance by such communities. Until express acceptance exists, CSIRT-BIGSECURE will not declare formal membership in such organizations.
CSIRT-BIGSECURE acts as a specialized technical unit of BIGSECURE S.A.C., with the capacity to coordinate, analyze, record, escalate and support the response to cybersecurity incidents within the scope of the services contracted by clients and the internal procedures approved by the organization.
The authority of CSIRT-BIGSECURE is based on the guidelines established by BIGSECURE S.A.C., the Information Security Management System, the Integrated Management System, contractual agreements with clients, service level agreements and the decisions of Senior Management or designated responsible parties.
CSIRT-BIGSECURE may coordinate technical actions with the SOC, the Information Security Area, the Engineering Area, the IMS Manager, Legal/Compliance, Administration and other support areas, depending on the nature, criticality and impact of the incident.
In the case of critical incidents, such as ransomware, active system compromise, information leakage, significant availability impact, unauthorized access or events that may affect service continuity, CSIRT-BIGSECURE may activate the escalation, containment, communication and coordination mechanisms defined by BIGSECURE S.A.C., in accordance with the contractual scope and applicable internal procedures.
Containment, mitigation, eradication or recovery actions involving client assets, systems or information will be coordinated with the client's authorized representatives, unless there is prior contractual authorization or a specific procedure that allows BIGSECURE S.A.C. to act directly within the contracted service.
When strategic coordination, external communication, legal validation, contractual handling or high-impact decision-making is required, CSIRT-BIGSECURE will escalate the case to Senior Management, the Information Security Area, Legal/Compliance or the corresponding internal body.
In the event of disagreement over a technical action or response decision, an internal escalation channel will be applied under the following reference order:
All formal coordination related to incidents must be channeled through the official CSIRT-BIGSECURE email address: csirt@bigsecure.net.
CSIRT-BIGSECURE will carry out its activities in accordance with BIGSECURE S.A.C.'s internal policies, procedures, controls and guidelines, considering the scope of the services contracted by clients, applicable service level agreements, the Information Security Management System, the Integrated Management System and good practices for cybersecurity incident response.
CSIRT-BIGSECURE activities will be governed by the following general principles:
Cybersecurity incidents must be reported to CSIRT-BIGSECURE through the official channel:
Notifications may be submitted by clients, BIGSECURE S.A.C. internal personnel, monitoring tools, authorized providers or other relevant parties, in accordance with the scope of the contracted services and the defined channels.
Every incident notification should include, to the extent possible, information that allows the initial analysis to be performed, such as:
For critical incidents or high-urgency situations, the word [URGENTE] must be placed at the beginning of the email subject line in order to facilitate prioritization and escalation.
CSIRT-BIGSECURE will record the received notification, perform the initial triage and determine the corresponding treatment according to criticality, impact, contractual scope and applicable internal procedures.
CSIRT-BIGSECURE will classify and assess reported or detected incidents considering criteria such as criticality, impact, urgency, scope, effect on confidentiality, integrity and availability, compromised services, number of affected users or assets, public exposure, contractual obligations, legal or regulatory risks and possible reputational impact.
The initial classification may consider reference levels such as:
The classification may be updated during the incident lifecycle as new technical information, evidence, actual scope, confirmed impact or escalation decisions are obtained.
CSIRT-BIGSECURE will document the assessment performed, actions adopted, responsible parties involved, communications issued and the corresponding closure.
External communication related to cybersecurity incidents will be managed in a controlled, coordinated and documented manner.
CSIRT-BIGSECURE may participate in the preparation of technical communications addressed to clients, providers, incident response teams, technical communities, competent authorities or other interested parties, as appropriate according to the scope of the incident, contractual obligations, legal requirements or BIGSECURE S.A.C. decisions.
When external communication involves clients, regulators, authorities, the press, critical third parties or possible legal or reputational impacts, it must be coordinated with Senior Management, Legal/Compliance, the Information Security Area and the relevant areas.
All external communication must seek to ensure that information is clear, truthful, timely, proportional, technically supported and limited to what is necessary, avoiding disclosure of sensitive information, personal data, confidential client information, unvalidated indicators or details that may increase risk.
Issued and received communications must be recorded as part of the incident file, including date, channel, recipient, responsible party, general content and associated evidence.
CSIRT-BIGSECURE provides services aimed at strengthening the capacity of BIGSECURE S.A.C. and its clients to prevent, detect, analyze, coordinate and respond to cybersecurity incidents, in accordance with the scope of contracted services, applicable service level agreements and the organization's internal procedures.
CSIRT-BIGSECURE services are grouped into proactive activities, reactive activities and security assessment.
CSIRT-BIGSECURE proactive activities are intended to anticipate, identify and warn about conditions that may increase exposure to cybersecurity threats, as well as strengthen prevention, monitoring and preparedness capabilities.
These activities may include:
CSIRT-BIGSECURE reactive activities are intended to handle, analyze, coordinate, contain, escalate, document and close cybersecurity incidents reported or detected within the scope of the services provided by BIGSECURE S.A.C.
These activities may include:
CSIRT-BIGSECURE security assessment activities will be aimed at supporting the identification, analysis and prioritization of risks, vulnerabilities, control weaknesses or technical conditions that may affect information security, service continuity or incident response capability.
These activities may include:
Security assessment activities will be performed in accordance with the contractual scope, availability of information, corresponding authorization, internal procedures and security guidelines defined by BIGSECURE S.A.C.
To report cybersecurity incidents, an email must be sent to the following official CSIRT-BIGSECURE address:
For critical incidents or high-urgency situations, it is recommended to place the word [URGENTE] at the beginning of the email subject line in order to facilitate prioritization and escalation.
Subject example: [URGENTE] Cybersecurity incident report - [Client name]
When notifying an incident, the following information should be provided, to the extent possible:
CSIRT-BIGSECURE may request additional information during the initial analysis of the incident in order to validate its scope, criticality, impact and corresponding response actions.
The information received will be handled in accordance with BIGSECURE S.A.C.'s internal information security guidelines, applicable contractual agreements, confidentiality commitments and applicable legal or regulatory provisions.
CSIRT-BIGSECURE will take reasonable precautions to ensure that the information, recommendations, alerts, reports and communications issued during incident management are clear, timely and technically supported, according to the information available at the time of issuance.
However, CSIRT-BIGSECURE does not guarantee that the information provided is complete, definitive or applicable to all scenarios, because cybersecurity incidents may evolve, present incomplete information or require additional technical validation.
Recommendations issued by CSIRT-BIGSECURE must be evaluated and applied considering the contractual scope of the service, client authorization, incident criticality, availability of evidence, internal procedures and the particular conditions of the affected environment.
CSIRT-BIGSECURE shall not be liable for damages, losses, interruptions, errors, omissions or consequences derived from the improper use, incorrect interpretation or unauthorized application of the information provided, unless there is an express obligation established in current contracts or service agreements with BIGSECURE S.A.C.
Information exchanged during incident handling will be treated with confidentiality and security criteria. However, the reporting party must avoid sending unnecessary, excessive or unauthorized information, especially personal data, credentials, private keys, technical secrets, confidential contractual information or sensitive data that are not essential for incident analysis.
This document does not replace contracts, service level agreements, internal policies, legal obligations, specific procedures or formal authorizations applicable between BIGSECURE S.A.C., its clients and other interested parties.