CERT-AGID RFC 2350

RFC 2350 – CERT-AGID
Team description, services and contact information
Draft update – 26 October 2026

1. DOCUMENT INFORMATION

1.1 Date of Last Update
Date of last revision: 26 October 2026

1.2 Distribution List for Notifications
Updated versions of this document are made available on the CERT-AGID official website.

1.3 Location of this Document
https://cert-agid.gov.it/cert-agid-rfc-2350/

1.4 Authentication of this Document
This draft is not digitally signed. Public keys for protected communications are identified in section 2.8. Publication of an OpenPGP-signed final version is recommended.

2. CONTACT INFORMATION

2.1 Name of the Team
CERT dell’Agenzia per l’Italia Digitale (CERT-AGID).

2.2 Postal Address
CERT-AGID, c/o Agenzia per l’Italia Digitale,
Via Liszt 21, 00144 Rome, Italy.

2.3 Time Zone
Europe/Rome: CET (UTC+1), CEST (UTC+2) during daylight saving time.

2.4 Telephone Number
+39 06 8526 4800

2.5 Facsimile Number
Not listed among the team’s public contact channels.

2.6 Other Telecommunication
Website: https://cert-agid.gov.it/

2.7 Electronic Mail Address
General inquiries and communications: info@cert-agid.gov.it
Voluntary submission of malware samples or malicious messages: malware@cert-agid.gov.it
CERT-AGID certified email (PEC): cert-agid@pec.agid.gov.it
AgID institutional certified email (PEC): protocollo@pec.agid.gov.it

2.8 Public Keys and Encryption
CERT-AGID supports OpenPGP/GPG. The team public key and available team-member keys are published at:
https://cert-agid.gov.it/contatti/
Team key fingerprint:
270E 2AAD 920C 4FD2 2BB2 264A 928F 85DF 96EB 6F09

2.9 Team Members
Publicly available contacts are listed on the CERT-AGID contacts page.

2.10 Other Information
CERT-AGID has held Accredited status in Trusted Introducer since 19 July 2016:
https://trusted-introducer.org/trusted-introducer/directory/teams/cert-agid/

2.11 Points of Customer Contact and Operating Hours
Monday to Friday, 09:00-18:00, excluding Italian public holidays, as listed by Trusted Introducer. The listed contact does not represent a public 24/7 incident-response service. For routine communications use the general email address in section 2.7.

3. CHARTER

3.1 Mission Statement
CERT-AGID monitors, analyses and shares information about malicious campaigns, provides technical indicators to Italian Public Administrations, and develops tools and awareness initiatives supporting prevention. It also provides technical security support to AgID’s projects and supervisory activities, including technical checks concerning qualified trust service providers. CERT-AGID carries out technical research and experimentation, including the security of artificial intelligence systems.

3.2 Constituency
Proactive services are intended for Italian Public Administrations, subject to the eligibility conditions of each service. Technical support for AgID’s institutional functions concerns activities and entities within AgID’s legal remit. This does not automatically grant access to services reserved for Public Administrations.

3.3 Sponsorship and Affiliation
CERT-AGID operates within AgID’s “Servizio Sicurezza informatica e Cert-AGID”, part of the “Area Vigilanza e sicurezza”.

3.4 Authority and Legal Framework
CERT-AGID operates within the powers attributed to AgID by the Digital Administration Code (Legislative Decree 7 March 2005, No. 82), the trust services legal framework (Regulation (EU) No 910/2014, as amended), and the 2024-2026 Three-Year ICT Plan for Public Administration, 2026 update, Chapter 7, Objective 7.6.
Technical support for inspections is provided within AgID’s institutional functions and does not grant CERT-AGID independent supervisory or sanctioning powers.

4. POLICIES

4.1 Types of Reports and Level of Support
CERT-AGID receives and assesses, for prevention and threat information purposes, reports of malware, phishing and other malicious campaigns. Submitting information does not constitute formal incident intake and does not entail a guaranteed response, intervention, or processing time.
Formal incident notifications, including those required under the NIS framework, must be sent to the relevant competent bodies using the channels prescribed by law, not to the CERT-AGID malware analysis mailbox.

4.2 Cooperation, Interaction and Disclosure of Information
Within its remit, CERT-AGID cooperates with Public Administrations and other relevant public and private stakeholders. It may share technical indicators and preventive information while respecting applicable law, confidentiality requirements and any relevant dissemination restrictions. It may also report malicious resources to service providers, without exercising any statutory removal powers.

4.3 Communication and Authentication
OpenPGP encryption is recommended for sensitive information, after independently verifying the published public-key fingerprint. Ordinary email does not ensure confidentiality. Formal communications addressed to AgID should use the appropriate institutional channels.

5. SERVICES

5.1 Incident Response
CERT-AGID does not provide Public Administrations with a national incident handling, operational coordination, containment or recovery service. Information and artefacts submitted may be analysed for prevention, awareness and technical indicator sharing. Formal incident handling and notification must follow the procedures and channels established by applicable law.

5.2 Proactive Activities

• Monitoring and analysis of malware, phishing and other malicious campaigns.
• Production and distribution of Indicators of Compromise (IoCs) to accredited Public Administrations.
• Tools and services for proactive checks and self-assessment of internet-exposed systems.
• Publication of technical analyses and guidance; awareness and training for Public Administrations and Digital Transition Officers (RTDs).
• Technical support on security aspects of AgID projects and supervisory inspections, including qualified trust services.
• Technical research and experimentation on security issues and potential AI applications for threat analysis.

IoC feed access is governed by the published accreditation procedure:
https://cert-agid.gov.it/scarica-il-modulo-accreditamento-feed-ioc/

6. REPORTING PROCEDURES

Malware samples or malicious messages may be shared voluntarily with:
malware@cert-agid.gov.it
As indicated on the CERT-AGID website, samples should be placed in an archive protected with the password “infected”. Avoid including personal or confidential information unless necessary and properly protected.
These submissions are solely for research and information-sharing purposes. They do not constitute formal incident notifications, criminal complaints or requests for mandatory intervention. See:
https://cert-agid.gov.it/contatti/

7. DISCLAIMERS

CERT-AGID information and tools are intended for prevention and support. They do not guarantee detection of all threats or freedom from false positives. Each administration remains responsible for assessing and deploying them in its own environment. Services are provided within AgID’s institutional remit, available resources and the terms applicable to each service.