Return to Policies
   Print Policy No: 2028
Return to Policies Print Policy No: 2028
University of South Alabama Logo     
Policy No: 2028
Responsible Office: Information Security
Last Review Date: 02/10/2022
Next Required Review: 02/10/2025
Policy No: 2028
Responsible Office: Information Security
Last Review Date: 02/10/2022
Next Required Review: 02/10/2025

InfoSec Incident Response

1. Purpose

此政策的目的是明确定义报告的角色和责任, 调查及处理电脑保安事故及资料外泄事件.

2. Applicability

大学社区的所有成员都有责任及时报告任何涉及十大彩票网投平台数据或相关信息系统的可疑或确认的安全事件, even if they have contributed in some way to the event or incident. 大学社区的成员必须配合和协助事件调查，并鼓励其员工和其他人报告事件并配合调查. 

3. Definitions

USA Data: includes, but is not limited to, the following: personnel data, student data (FERPA), 由支付卡行业数据安全标准(PCI DSS)定义的信用卡/支付数据, 《十大彩票网投平台》(HIPAA)规定的受保护的健康信息(PHI), and controlled unclassified information (CUI).

4. Policy Guidelines

十大彩票网投平台成立了网络风险小组(CRT)，以审查和加强大学的信息安全计划. CRT调查安全事件以确定是否发生了事件, and the extent, cause and damage of incidents. CRT由来自大学不同院系的多元化员工组成.

The CRT directs the recovery, 遏制和补救安全事件，并可能授权和加快对信息系统进行必要的更改. 当现有协议规定事故调查的责任由外部方承担时，应急反应小组与外部方协调回应.

During the conduct of security incident investigations, CRT被授权监控相关的美国IT资源，并检索美国IT资源特定用户的通信和其他相关记录, 包括登录会话数据和个人通信内容，无需通知或进一步批准.

任何有关信息安全事件的外部信息披露都必须经过总法律顾问办公室的审查和批准.

The CRT coordinates with law enforcement, government agencies, 对端crt和相关的isac (Information Sharing and Analysis center)进行安全事件的识别和调查. CRT可以与这些组织共享威胁和事件信息，但不确定南阿拉巴马州社区的任何成员.

This policy applies to information systems, regardless of ownership or location, used to store, process, transmit or access USA Data as well as all personnel including employees, students, temporary workers, contractors, 合同实体雇用的人员和其他有权访问美国企业资产和信息资源的人员.

5. Procedures

All suspected information security (IS) incidents must be reported. 一旦发现资讯保安事故，应采取以下行动:

5.1  如果事件涉及电子或纸质形式的受保护健康信息(PHI):

    • 请致电美国首席HIPAA合规官(251)470-5802或合规办公室(251)460-7115.

5.2  对于所有其他事件，请通知部门IT联系人和/或CSC帮助台(6-6161). 如果发生任何可疑的IS事件，IT联系人或帮助台也将通过拨打电话(251)460-6161和/或发送电子邮件至infosec@southalabama十大彩票网投平台安全部门.edu. It is highly recommended to make a phone call. Include particular information if the incident involves:

    • Inadvertent release, exposure, or compromise of confidential data, 包含敏感数据的便携式计算设备或可移动媒体的丢失或泄露, 或发现未经授权访问计算机或数据存储设备上的敏感数据;
    • 利用美国计算机资源进行欺诈活动;
    • Systems used to process or store Controlled Unclassified Information (CUI).

5.3  If the suspected incident involves any of the following, the Information Security Department will work to also report:

    • Credit or debit card account information, notify the Tax Accounting Office, (251) 414-8297, and speak to the PCI Coordinator;
    • 通知美国首席HIPAA合规官，电话:(251)470-5802或合规办公室(251)460-7115;
    • Fraudulent activity committed using USA computing resources; notify the Department of Internal Audit at (251) 460-7087;
    • Criminal activity committed using USA computing resources; notify the USA Police Department at (251) 460-6312;
    • 受控非机密信息(CUI)相关事件(系统和/或数据), the Director, IT Risk and Compliance at 251-460-7994;
    • FERPA不要求披露数据泄露，但应联系大学注册办公室.

当根据与信息技术有关的任何调查发出传票或法院命令时，必须通知美国总法律顾问办公室，并将指导采取行动. 大学警察和总法律顾问办公室将作为与所有外部执法机构(联邦调查局)的联络人, other federal, state, local) for all IT security investigations.

The University encourages stakeholders to report other concerns, suspected violations, 或向他们的主管或其他校园实体举报犯罪行为. 部门资讯科技联络人负责向所属部门宣传这项政策. 网络反应小组(CRT)负责根据既定程序对严重事件作出反应. 资讯保安署署长负责协调对照表的工作，并在有需要时增调有关专家.

6. Enforcement

任何被发现故意违反本政策或误导事件响应调查的美国员工将受到纪律处分，直至并包括失去工作.

7. Related Documents

Not Applicable.