# 4.3 Cybersecurity Incident Response Plan **Effective Date: September 17, 2025 Revised Date: August 14, 2026 Responsible Office: Information Technology Services (ITS)** #### 1. Preface This document and its contents exist to manage and respond to cybersecurity incidents only. Anyone suspecting an exposure of university data or systems should immediately contact: - **IT Support Services (Help Desk):** 870-972-3933 - **IT Security Team:** security@astate.edu or 870-680-3770 If you are experiencing a non-cybersecurity related security incident and need immediate support, please contact: **University Police Department (UPD)**: 870-972-2093 (24/7 Dispatch) Technical access or administrative capability **does not** independently authorize investigation, forensic analysis, disclosure determination, or incident notification. Staff with administrative access are entrusted with privileged access to university systems, applications, networks, accounts, logs, databases, and institutional information because that access is necessary to administer, maintain, and support university technology resources. When a potential cybersecurity incident or data breach is suspected, **all** staff, including ITS personnel, should report, preserve, and escalate the matter rather than independently determining whether a breach has occurred, what regulatory or legal requirements apply, whether affected individuals should be notified, or which institutional stakeholders should be involved. --- #### 2. Purpose This cybersecurity incident response plan (IRP) provides a comprehensive overview of how Information Technology Services (ITS) staff respond to and recover from identified cybersecurity incidents impacting Arkansas State University Jonesboro (A-State). This IRP identifies and clearly establishes responsibilities during cybersecurity incidents, outlines generic response steps, and ensures institutional data and infrastructure is adequately protected during a true incident. --- #### 3. Scope This IRP applies to all data, personnel, assets, information management systems, and technology resources under the responsibility of ITS. Where applicable, specific security incident response plan specifics will not be covered as their responsibility or impact lay outside of ITS and may not be considered a “cybersecurity” incident (e.g., active shooter incident). This plan also extends to certain members of university leadership outside of ITS (e.g., Chancellors Cabinet, General Counsel, University Communications). Where applicable, the Arkansas State University Police Department (UPD) and the Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force) will be involved. --- #### 4. Definitions - **Cybersecurity Incident** - An occurrence that— (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. - **Security Panel** – The individuals responsible for investigating data breaches or other cybersecurity incidents. This panel is comprised of all members of the ITS Senior Leadership and senior members of the IT Security team. - **Incident Response Coordinator**– The technical lead of the incident response process. Authorizes next steps, including emergency containment actions, and works to ensure adequate resources are made available to other technical staff working on the incident. Ensures the executive lead is adequately informed, and that incident response actions are minimally disruptive to the operations of A-State. - **Executive Response Coordinator**– The individual responsible for coordinating with university leadership outside of ITS. Provides adequate and timely updates to key stakeholders and works to ensure adequate resources are made available to the security panel in the pursuit of incident response and remediation. --- #### 5. Responsibilities All personnel involved in the c ybersecurity incident response process. This includes:
- Chief Information Officer (CIO) - Responsible for the executive sponsorship, governance, and oversight of the University’s incident response processes within the scope of this plan . Ensures that applicable regulatory, statutory, and contractual obligations are identified , translated into actionable controls, and operationalized across institutional systems and processes. Serves as the executive response coordinator during any true-positive cybersecurity incident.
- Director of IT Security – Responsible for the management of A-State's information security program and oversight of the IT security team. Serves as a member of the security panel and generally as the incident response coordinator duri ng any true-positive cybersecurity incident. Depending on the circumstances of any true-positive incident, other individuals on the security panel may serve as the incident response coordinator .
- IT Security Team – Responsible for confirming the validity of reported or alerted cybersecurity incidents. Notifies the security panel upon confirmation of a true positive incident or when an incident cannot be confirmed as false-positive. Provides accurate working data to technical staff and helps to support incident response actions.
- Security Panel – Responsible for coordinating technical staff as needed to complete remedial actions during the incident response. Assists with documenting all actions taken and for assisting as necessary with campus coordination.
- Technical Staff – Responsible for gathering data from information systems, providing expertise and guidance in technical platforms, the execution of directed remedial actions, and completing adequate documentation of all remedial actions taken at the directio n of the security panel.
- Office of Risk Management – Responsible for ensuring incident response actions are aligned with the university’s overall enterprise risk management framework. Serves as the liaison for institutional cyber liability insurance claims, ensuring required documentation and reporting are completed.
- General Counsel – Responsible for advising on legal, regulatory, contractual, evidentiary, and notification obligations related to cybersecurity incidents. Coordinates legal review of external communications and breach notification determinations where applicable.
- University Communications – Responsible for coordinating public, campus-wide, media-facing, or stakeholder communications related to cybersecurity incidents, in coordination with the Executive Response Coordinator, General Counsel, and applicable university leadership.
--- #### 6. Security Panel Composition
The A-State security panel is comprised of all members of the ITS Senior Leadership and senior members of the IT Security team. This composition ensures that every area is represented in the incident response process and that technical staff from every area are at the disposal of the panel during remedial efforts. This includes:
- Chief Information Officer (CIO)
- Director of IT Security
- Assistant Vice Chancellor of IT Infrastructure and Operations
- Assistant Vice Chancellor/ERP Systems
- Director of Hardware and Communication Services
- Senior Director of Academic Technology and Data Analytics
- Budget Director
- Senior IT Security Analyst
- Security Operations Center Coordinator
--- #### 7. Incident Response Stages
A-State follows a multi-stage incident response process to ensure potential incidents are appropriately vetted and verified before technical resources are assigned to remedial actions. These stages ar e:
- Identification and Confirmation
- Assessment
- Containment
- Eradication and Recovery
- Post-Incident Activity Given the wide variety of cybersecurity incidents that can occur in an enterprise environment and the need for a concise, easy to follow plan during an incident, these stages will not contain step by step instructions for each potential incident category.
--- #### 8. Incident Categories and Severity Incident – Per the Federal Information Security Modernization Act of 2014 (FISMA), as codified at 44 U.S.C. § 3552(b)(2): An occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. Major Incident – Per the Office of Management and Budget (OMB) Memorandum M-20-04 or subsequent memo, a major incident is either:
1. Any incident that is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.40 Agencies should determine the level of impact of the incident by using the existing incident management process established in the National Institute of Standards and Technology (NIST) Special Publication (SP) 900-61 Revision 2, Computer Security Incident Handling Guide.
or,
2. A breach that involves personally identifiable information (PII) that, if exfiltrated, modified, deleted, or otherwise compromised, is likely to result in demonstrable harm to the national security interests, foreign relations, or the economy of the United States, or to the public confidence, civil liberties, or public health and safety of the American people. Major incident determination is required for breaches involving PII of 100,000 or more people .
Breach – Per OMB Memorandum M-17-12 or subsequent memo: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for other than authorized purpose. Event – Per NIST SP 900-61 Revision 2: An event is any observable occurrence in a system or network. Vulnerabilities :
- Internal discovery of potential compromise l everaging a vulnerability
- Known exploitation of vulnerability (NVD tagged entries; wide-spread public reporting; viable proof-of-concept exploit released, etc.)
Incident severity will be directly correlated with the classification of the impacted data and the number of users impacted .
Data Classification Tier Examples Alternate User Impacted Tier Incident Severity
Public Websites and public research 1-250 Low
Internal Internal memos or procedures 251-2 , 500 Medium
Confidential FERPA records, personnel files 2,501-10,000 High
Regulated HIPAA,PCI , CJIS,GLBA 10,001+ Critical
--- #### 9. Identification and Confirmation Stage Upon receipt of an alert or report of a suspected cybersecurity incident, the notified staff should convey all relevant information to the IT security team ( [ security@astate.edu ](mailto:security@astate.edu) ) for review. During this review, the IT security team will work to confirm the validity of the incident and take the following action(s):
- False Positive Report - Proceed with standard internal procedures depending on the reported incident. Consult with the Director of IT Security if no internal procedure exists. - Security panel will not be notified of false positive reports. - True Positive or Unconfirmed Report - Escalate the reported incident to the Director of IT Security. If the reported incident is still confirmed as true positive or cannot be confirmed as a false positive, the security panel will be not ified and convene for assessment and remediation. - If a reported incident is in the unconfirmed category, it will be treated as a true positive incident by the security panel until otherwise proven false.
When reporting a true positive or unconfirmed report to the security panel, the following information should be provided to expedite the assessment stage:
- What was the initial attack vector?
- Is the threat actor exploiting vulnerabilities to achieve access or privilege?
- Does the threat actor have persistence on the network or device?
- What accounts have been compromised and what privilege level do they have?
- Is this an on-premises , vendor driven, or hybrid incident?
--- #### 10. Assessment Stage F ollowing the confirmation of a true positive cybersecurity incident, the security panel will be notified and convene to complete an assessment . This assessment will help to gauge the scope of impact and to identify which technical staff need to be allocated to incident containment and eradication / recovery. During this assessment, the following information will be determined :
- System(s) impacted ? - Is the incident stable, or is the scope continuing to grow? - What data classification(s) are impacted or at risk? See Data Classification Policy for assistance with identification. - What campus service(s) are degraded? - Wh ich technical staff are critical to incident containment?
Prior to moving into the containment phase, the Executive Response Coordinator will notify, at a minimum, the Office of Risk Management to ensure cyber liability insurance requirements are met. Unless otherwise necessary, the CIO will serve as the Executive Response Coordinator. The final step of the assessment stage is to identify an appropriate Incident Response Coordinator based on the specific details of the incident. Generally, the Director of IT Security will serve in this capacity, but specific incident circumstances may make another member of the Security Panel a more suitable candidate.
---
#### 11. Containment Stage
Following a thorough assessment of the reported cybersecurity incident, the Incident Response Coordinator will begin to leverage all available resources (Security Panel members, technical staff, IT Security team members, etc.) to begin the containment stage. The primary objective of this stage is to prevent further damage to institutional resources and reduce the immediate impact of the incident. The specific approach to containment will vary depending on the type of incident .
Ensure that the containment scope encompasses all related incidents and activity—especially all adversary activity. If new signs of compromise are found, return to the assessment stage to re- scope the incident. Upon successful containment (i.e., no new signs of compromise), preserve evidence for reference or law enforcement investigation, adjust detection tools, and move to eradication and recovery.
Parallel to the containment activities led by the Incident Response Coordinator, the Executive Response Coordinator will be expected to provide an initial communication to campus or other relevant stakeholders regarding the incident (if appropriate at this stage).
---
#### 12. Eradication and Recovery Stage
Once the incident is sufficiently contained , the eradication and recovery stage of the IRP can be executed by the Incident Response Coordinator. Prior to any actions being taken in this stage, ensure that evidence will not be compromised by remedial actions and that law enforcement or commercial vendors have been coordinated with.
The objective of this stage is to allow the return of normal operations by eliminating artifacts of the incident (e.g., remove malicious code, re-image infected systems) and mitigating the vulnerabilities or other conditions that were exploited. Before moving to eradication, ensure that all means of persistent access into the network have been accounted for, that the adversary activity is sufficiently contained , and that all evidence has been collected. This is often an iterative process and is possible that eradication and recovery actions can be executed simultaneously.
To validate normal operations have resumed, consider performing an independent test or review of compromise/response-related activity. To help detect related attacks, review cyber threat intelligence (including network situational awareness), and closely monitor the environment for evidence of threat actor activity.
---
#### 13. Post Incident Activity Stage Following the closure of any incident, the security panel must complete a post-incident review to capture lessons learned, identify improvements, and ensure preventative measures are implemented. The following checklist should be addressed and documented for every incident:
1. Policy Gaps – Could an additional policy have prevented the incident?
2. Policy/Procedure Compliance – Was a policy or procedure not followed, enabling the incident? What steps can be taken to ensure compliance going forward?
3. Response Effectiveness – Was the incident response appropriate and timely ? How could the response process be improved?
4. Communication Timeliness – Were all appropriate parties informed in a timely manner ?
5. Procedure Adequacy – Did the documented incident response procedures cover the full scope of the situation?
6. Remediation Actions – Have corrective actions been implemented?
7. Prevention of Recurrence – Have changes been made to prevent a similar or related incident in the future?
8. Follow-Up Plan – Has a follow-up plan or assessment been established , and are responsibilities and timelines documented?
9. Risk Management – Was Office of Risk Management notified for assessment of financial/reputational impact and insurance coverage?
--- #### 14. Standards Review This plan will be reviewed annually by the CIO, CISO, and ITS Security Panel, or sooner if significant changes occur to technology, organizational structure, or applicable regulations. Effective Date: September 17 , 202 5 Next Review Date: June 29, 202 7 Version: 2 . 0 Referenced Policies, Standards, and Procedures:
- Data Classification Policy
--- #### Appendix A – Security Panel Contact List
Security Panel Contact List
Christopher Boothman CIO 870-253-8184
Jacob Weaver Director of IT Security 870-680-4259
Himaja Balakrishnan Assistant Vice Chancellor of IT Infrastructure and Operations 870-972-3840
Deanna Warren Assistant Vice Chancellor/ERP Systems 870-972-3033
Justin Carothers Senior Director of Academic Technology and Data Analytics 870-680-8332
Vanessa Williams Budget Director 870-680-4128
Chase Roberson Senior IT Security Analyst 870-868-1867
Kelsie McDole Security Operations Center Coordinator 870-680-4273
Law Enforcement Contact List
University Police Department (UPD): 870-972-2093 (24/7 Dispatch)
FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700
Jonesboro Police Department (through UPD coordination): 870-935-5551
--- #### Appendix B – IT Security Incident Report **Date of Report:** \_\_\_\_ **Prepared By:** \_\_\_\_ **Incident Date:** \_\_\_\_ ##### 1. Executive Summary Brief overview of the incident, severity, and outcome. ##### 2. Incident Overview & Key Timestamps Identify severity (IRP category), affected assets/data, and critical timestamps (detection, containment, recovery). ##### 3. Initial Indicators Describe type, initial vector, and IOCs/IOAs. ##### 4. Containment & Mitigation Actions Document containment steps, approvals, and responsible parties. ##### 5. Evidence Log & Chain of Custody Record all collected evidence with dates, handlers, and transfers to ensure integrity and a clear chain of custody (if applicable). If UPD/FBI notified, list contact name, agency, and case number obtained. ##### 6. Notifications & Communications List all internal/external notifications with times and methods. ##### 7. Root Cause Analysis Summarize underlying vulnerabilities, process gaps, or third-party issues. ##### 8. Timeline of Events
DateEvent Description
ENTER DATEENTER TEXT
ENTER DATEENTER TEXT
ENTER DATEENTER TEXT
##### 9. Lessons Learned Document what worked, what didn’t, and improvement areas. ##### 10. Recommendations List technical and procedural remediation items. ##### 11. Review & Approval Sign-offs by CIO/CISO and Risk Management (if applicable). ---