RFC 2350

Public Computer Security Incident Response Team of Mongolia (Public CSIRT/CC)

1. Document Information

Item	Information
1.1 Date of Last Update	2025-09-16
1.2 Distribution List for Notifications	N/A
1.3 Locations where this Document May Be Found	https://www.pubcert.mn/en/rfc2350

2. Contact Information

Item	Information
2.1 Name of the Team	Full name: Public Computer Security Incident Response Team of Mongolia Short name: Public CSIRT of Mongolia (Pubcert)
2.2 Address	801, Tod Tower, 23 Ankara Street, 4th Khoroo, Chingeltei District, Ulaanbaatar 15160, Mongolia
2.3 Time Zone	Ulaanbaatar Time (ULAT), UTC +8
2.4 Telephone	+976 7000-1113
2.5 Facsimile	N/A
2.6 Other Telecommunication	N/A
2.7 Electronic Mail	contact@pubcert.mn
2.8 Public Keys and Encryption	N/A
2.9 Team Members	The Public CSIRT of Mongolia is composed of IT security experts. The list of the Public CSIRT of Mongolia’s members is not publicly available. The identity of the team’s members may be disclosed on a case-by-case basis.
2.10 Other Information	https://www.pubcert.mn
2.11 Points of Customer Contact	• Email: contact@pubcert.mn • Hotline (incidents): 113 • General inquiries: +976 7000 1113 • Online form: https://www.113.mn

3. Charter

3.1 Mission Statement

The Public CSIRT/CC works to prevent, detect, stop, and respond to cyber-attacks and security incidents affecting the information systems and networks of citizens, legal entities, and organizations operating critical information infrastructure in Mongolia.

3.2 Constituency

Critical information-infrastructure organizations
Private-sector organizations
Citizens and legal entities requesting assistance with cybersecurity incidents

3.3 Sponsorship / Affiliation

The Public CSIRT of Mongolia operates under the Ministry of Digital Development, Innovation and Communications of Mongolia.

The team is also a member of the Forum of Incident Response and Security Teams (FIRST) and the Asia Pacific Computer Emergency Response Team (APCERT) communities.

3.4 Authority

Authorized by the Ministry of Digital Development, Innovation and Communications to coordinate incident response, provide guidance, and issue advisories to its constituency.

4. Policies

4.1 Types of Incidents and Level of Support

Handles (but is not limited to): malware/ransomware, phishing/social engineering, unauthorized access, DoS/DDoS, web defacement, data breaches, vulnerability reports.

4.2 Cooperation, Interaction & Disclosure

Cooperates with government agencies, CII organizations, private organizations, and other CSIRTs. Information is confidential unless disclosure is authorized or required by law.

4.3 Communication & Authentication

N/A (team may later define procedures for PGP or other authenticated channels).

5. Services

5.1 Incident Response

Triage – validate, classify, log reports.
Coordination – consult with victims, ISPs, regulators, law enforcement.
Resolution – analyze evidence, advise on eradication/restoration, confirm safe recovery.

5.2 Proactive Activities

Security guidance and best practices
Training & awareness
Internet monitoring and vulnerability scanning (where agreed)
Threat-data analysis and advisories
Research and consulting for national cyber resilience.

6. Incident Reporting Forms

Hotline 113 (urgent)
Online form: https://www.113.mn