TCR-IT-010: Incident Response Plan
Summary
Section titled “Summary”Procedures for detecting, reporting, and responding to cybersecurity incidents. Applies to all faculty, staff, students, and any third parties affiliated with TCR’s IT infrastructure and data.
Why it exists
Section titled “Why it exists”When an incident happens, the difference between a contained problem and a serious breach usually comes down to how fast and how coordinated the response is. This plan exists so that response isn’t improvised in the moment: detection, classification, containment, and recovery are defined ahead of time.
Policy
Section titled “Policy”Detection and reporting
Section titled “Detection and reporting”Everyone in the TCR community is responsible for reporting suspicious activity or suspected incidents immediately to the IT Security Team, via email, phone, or a dedicated incident reporting portal.
Classification
Section titled “Classification”The IT Security Team conducts an initial assessment and classifies incidents as Low, Medium, High, or Critical, based on data sensitivity, affected systems, and operational impact.
Incident Response Team (IRT) activation
Section titled “Incident Response Team (IRT) activation”The IRT includes members from the IT Security Team, relevant IT departments, legal counsel, and communications. For High or Critical incidents, the IRT activates immediately.
Containment
Section titled “Containment”The primary objective is preventing further damage: isolating affected systems, revoking access, or implementing temporary fixes, with strategy determined by the nature and extent of the incident.
Investigation and analysis
Section titled “Investigation and analysis”The IRT collects relevant data (logs, system images, access records) and conducts root cause analysis to prevent recurrence.
Eradication and recovery
Section titled “Eradication and recovery”Once the cause is identified, the threat is eliminated from the environment and systems/data are restored from backups, ensuring no remnants remain.
Notification and communication
Section titled “Notification and communication”Internal stakeholders (department heads, affected users) are notified based on severity. External parties (law enforcement, regulators, affected individuals) are notified where legally or regulatorily required.
Post-incident analysis
Section titled “Post-incident analysis”After resolution, the IRT debriefs on the response process and effectiveness, documenting lessons learned and improvement recommendations.
Enforcement
Section titled “Enforcement”Failure to adhere to this plan may result in disciplinary action and could negatively impact TCR’s cybersecurity posture and legal/regulatory compliance.
Review
Section titled “Review”Reviewed and updated annually, or following significant incidents, to reflect changes in threats, technologies, and best practices.
Digitized from TCR-IT-010 - Incident Response Plan [Rev 1.0].docx; the original is kept under source/policies/ in this repo.