4.3 Cybersecurity Incident Response Plan

Effective Date: September 17, 2025 
Revised Date: OctoberJune 20,29, 20252026 
Responsible Office: Information Technology Services (ITS)
Contact: ITS Security Panel – security@AState.edu | ITS Help Desk – (870) 972-3033

1. Preface

This document and its contents exist to manage and respond to cybersecurity incidents only. Anyone suspecting an exposure of university data or systems should immediately contact:  

• IT Support Services (Help Desk): 870-972-3933 
• IT Security Team: security@astate.edu or 870-680-3770 

If you are experiencing a non-cybersecurity related security incident and need immediate support, please contact:  

University Police Department (UPD): 870-972-2093 (24/7 Dispatch) 

---

2. Purpose

TheThis purposecybersecurity ofincident thisresponse plan is to establish a structured Incident Response Plan (IRP) frameworkprovides fora identifying,comprehensive respondingoverview to,of how Information Technology Services (ITS) staff respond to and recoveringrecover from informationidentified securitycybersecurity incidents atimpacting Arkansas State University.University TheJonesboro plan(A-State). This IRP identifies and clearly establishes responsibilities during cybersecurity incidents, outlines generic response steps, and ensures timely response, minimizes disruption to university operations, protects institutional data and assets,infrastructure andis supportsadequately complianceprotected withduring applicablea lawstrue andincident. regulations.

---

2.3. Scope

This IRP applies to all Informationdata, Technologypersonnel, Servicesassets, (ITS)information staffmanagement at Arkansas State University, including Security, Networking, Systems, Infrastructure, Hardware Services, Help Desk,systems, and Cardtechnology Centerresources units.under Thesethe groupsresponsibility areof directlyITS. responsibleWhere forapplicable, executingspecific security incident response actionsplan specifics will not be covered as outlinedtheir inresponsibility thisor plan.impact lay outside of ITS and may not be considered a “cybersecurity” incident (e.g., active shooter incident).  

TheThis plan also extends to certain members of university leadership andoutside supportingof functions – including the CIO, CISO, Executive LeadershipITS (Chancellor’se.g., Cabinet),Chancellors Cabinet, General Counsel, University Communications, and Risk Management – roles are defined in Section 5.Communications). Where applicable, the Arkansas State University Police Department (UPD) and the Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force) will be involved.

 

Third-party vendors and service providers with access to university systems or data are expected to cooperate fully with ITS, in incident investigation, containment, and remediation activities, and may be required to meet contractual or regulatory obligations (e.g., breach notifications, forensic reporting).

---

3.4. General PrinciplesDefinitions

ITS has the following general principles related to this IRP:

• IncidentsCybersecurity mustIncident be- reportedAn immediatelyoccurrence that— (“IfA) inactually doubt,or reportimminently it”).jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. 
• ContainmentSecurity Panel – The individuals responsible for investigating data breaches or other cybersecurity incidents. This panel is comprised of all members of the ITS Senior Leadership and evidencesenior preservationmembers precedeof recoverythe actions.IT Security team.  
• AllIncident responsesResponse mustCoordinator– followThe chain-of-commandtechnical authoritylead asof outlinedthe incident response process. Authorizes next steps, including emergency containment actions, and works to ensure adequate resources are made available to other technical staff working on the incident. Ensures the executive lead is adequately informed, and that incident response actions are minimally disruptive to the operations of A-State.  
• Executive Response Coordinator– The individual responsible for coordinating with university leadership outside of ITS. Provides adequate and timely updates to key stakeholders and works to ensure adequate resources are made available to the security panel in the Rolespursuit &of Responsibilitiesincident section.
• Documentationresponse and lessonsremediation.  learned are mandatory for every incident.
• Compliance with applicable laws (FERPA, HIPAA, GLBA, PCI, state/federal breach laws) is required.

---

4.5. Incident Response Plan (IRP) ProceduresResponsibilities

TheAll following steps are designed to ensure incidents are identified, assessed, contained, eradicated, and resolved in a timely and coordinated manner, while preserving evidence, maintaining compliance with regulatory requirements, and minimizing disruption to university operations.

1. Report the incident immediately.

   The person who discovers the incident will notify the ITS Security Panel (see Appendix A for contacts), email security@astate.edu, contact the ITS front desk at 870-972-3033, or after normal business hours call 870-253-8184. If in doubt, report it.
   
   

2. Initial notification & logging (by first panel member reached).

   Notify the ITS Security Panel and appropriate staff using WebEx/Teams/phone; use email only as backup (email may be part of the compromise). Log initial details on the IT Security Incident Report (Appendix B).
   
   

3. Initial assessment (by Security Panel).

   Meet or confer via phone, Microsoft Teams, or WebEx to evaluate status and immediate needs addressing the following questions to gain further insight into the incident:

   • Is the incident still in progress? If yes, take immediate containment action to disconnect or isolate the incident.
   • What data/property is threatened/compromised, and how critical is it?
   • What is/was the impact if the attack succeeds or has succeeded (minimal, serious, or critical)?
   • What system(s) are targeted, and where are they located (physical/network)?
   • Are regulated/sensitive datapersonnel involved (e.g. FERPA, HIPAA, GLBA, PCI, sponsored research)?
   • Are third-party vendors/cloud systems impacted? (open vendor ticket/escalation if so)
     
     
4. Categorize the incident (highest applicable level).
   The incident will be categorized into the highest applicable level of one of the following categories:
   
   
   • Category one (Data Breach/Confidentiality Compromise)
     Unauthorized access, disclosure, or exfiltration of sensitive or regulated information (FERPA, HIPAA, GLBA, PCI, PII, research data).
     
     Examples:
     • Ransomware
     • Database intrusion
     • Stolen credentials used to access Banner
     • Exposure of SSNs in files
       
       
   • Category two (System Integrity Compromise)
     Malicious activity that undermines the trustworthiness or normal function of university systems.
     
     Examples:
     
     • Localized ransomware detected and contained before propagation or data exposure.
     • Malware infection
     • Website defacement
     • Rootkit installation
       
       
   • Category three (Service Availability Disruption)
     Denial or degradation of critical IT services.
     
     Examples:
     • DDoS attack on campus internet
     • LMS/email outage
     • Server crash from attack
       
       
   • Category four (Policy/Compliance Violation or Suspicious Activity)
     Incidents that do not rise to the level of breach/system compromise, but indicate misuse, non-compliance, or attempted attack requiring investigation.
     
     Examples:
     • Phishing attempts
     • Repeated failed logins
     • Unauthorized software installation
     • Use of unapproved cloud storage
       
       Routine Category Four events (e.g., single compromised accounts, isolated phishing attempts, or minor compliance violations) do not require a full invocation of the Incident Response Plan (IRP).
       
       These events should still be:
     • Documented via an Incident Response Form.
     • Reported to the Security Panel for awareness, tracking, and trend analysis.
       
       Escalation criteria: If the incident escalates in scale, impact, or regulatory risk the incident should be re-classified into the highest applicable category (Category 1 - 3) and the full IRP should be triggered.
       
       
5. Legal & compliance notifications.
   If PII or regulated data may be involved, notify University Legal Counsel for statutory notification guidance. The CIO (or CIO’s designee) will coordinate with Legal and University Communications for mandatory notices (state legislative audit/federal law; FERPA, HIPAA, PCI; GDPR if applicable).
   
   
6. Law Enforcement & External notifications.

   The Incident Response Lead, in consultation with the CIO and Legal Counsel, must determine whether an incident meets the criteria for mandatory law-enforcement notification.
   
   

   Notify law enforcement (UPD and FBI) within 60 minutes when any of the following apply:

   • Confirmed or suspected criminal activity (unauthorized intrusion, data exfiltration, extortion, or ransomware).
   • Significant sensitive or regulated data exposure (FERPA, HIPAA, GLBA, PCI, CJIS, PII).
   • Evidence of credential theft or account takeover at scale.
   • Significant financial loss or fraud (e.g., business email compromise).
   • Threats to life/safety or potential national-security implications.
     
     

   Contact order (phone preferred; do not use email):

   • University Police Department (UPD): 870-972-2093 – establish a campus case number, coordinate chain-of-custody, and initiate contact with local/federal agencies.
   • FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700 — engage for coordination on active intrusion, ransomware, or data-theft cases.
   • Jonesboro Police Department (as directed by UPD): 870-935-5551.
     
     

   All notifications must be documented in Appendix B, Section 6 (Notification & Communications).
   
   

7. Containment & Evidence Preservation (Before Changes).

   Based on the assessment, follow the appropriate procedure/runbook (see Incident Response Procedures/Contact List). Prioritize isolation/containment to limit spread.

   • Preserve evidence (volatile and at-rest) and maintain chain of custody with UPD if needed.
   • Capture memory/volatile data where feasible before shutdown/rebuild.
   • Do not alter systems beyond what is required for containment without forensics and executive leadership approval.
   • When law enforcement involvement is triggered; the CISO/Incident Lead must coordinate with UPD to establish an evidence chain-of-custody. All evidence transfers to UPD or FBI must be logged (see Appendix B, §5), sealed, and hashed for integrity verification.
     
     

8. Forensics and Root Cause

   Authorized team members will use forensic techniques (log review, sensor/IDS data, imaging, interviews) to determine cause, scope, dwell time, and affected assets. Log all forensics activity; preserve evidence per chain-of-custody requirements. Recommend specific preventive changes. Approved third-party vendors may be utilized to support forensic analysis.
   
   

9. Eradication & Recovery (Authorization Required)
   With CIO (or CIO’s designee) approval, proceed to eradication and recovery:
   • Rebuild/re-image affected systems and restore data from clean backups as necessary.
   • Require password resets where credential compromise is possible.
   • Harden systems (remove/disable unused services).
   • Apply current patches/updates.
   • Ensure real-time malware protection/EDR and network IDS are active.
   • Verify logging is enabled at appropriate levels and forwarding to central SIEM.
   • Validate clean state (scans, EDR health, integrity checks) before returning to full service.
     
     
10. Documentation
    The following shall be documented and filed with the CIO (or CIO’s designee) (see Incident Identification form):
    • How the incident was discovered.
    • The category of the incident.
    • Initial attack vector (e.g., email, web, RDP, vendor) - How the incident occurred, whether through email, firewall, etc.
    • Origin indicators (IPs, accounts, domains, TTPs, IOCs) - Where the attack came from, such as IP addresses and other related information about the attacker.
    • Response actions taken and by whom.
    • Effectiveness of actions and residual risk.
      
      
11. Evidence Retention
    Copies of logs, emails, images, and other records will be retained as evidence for as long as necessary to complete investigation and any legal proceedings, including appeals, per Arkansas State University’s records retention policy and legal guidance.
    
    
12. Impact & Cost Assessment
    Assess organizational impact and estimate direct and indirect costs (containment, recovery, vendor services, lost productivity, reputational impact, student/faculty disruption).
    
    
13. Lessons Learned & Procedure Updates
    Within 30 days of incident closure, conduct a formal post-incident review. Update procedures, controls, and training. Track and assign actions to owners with due dates.
    
    
14. Communications & Follow-Up Plan
    Determine required announcements, audiences (executives, IT staff, campus community), frequency, timeline, and responsible owner. Use approved communications templates as provided by Chief Communications Officer and retain copies in the incident record.
    
    
15. Closure
    Review the Incident Post-Review Checklist (Section 6) and file with the CIO (or CIO’s designee). Ensure all assigned remediation items are tracked to completion.

---

5. Roles, Responsibility, and Authority

Effectivecybersecurity incident response requires clear roles, responsibilities, and decision-making authority.process. This sectionincludes: defines the responsibilities and authority of the CIO, CISO/Incident Response Lead, the ITS Security Panel, Executive Leadership, Legal Counsel, University Communications, Risk Management (and UPD/FBI where applicable) to ensure coordinated and efficient response to IT security incidents.

5.1

• Chief Information Officer (CIO)

Responsibilities

-

• Provides overall leadershipResponsible for Informationthe Technologyexecutive Servicessponsorship, governance, and ensures alignmentoversight of the University’s incident response withprocesses institutionalwithin goals.
the
• Approvesscope of this plan. Ensures that applicable regulatory, statutory, and enforcescontractual theobligations Incidentare Responseidentified, Plantranslated (IRP)into actionable controls, and relatedoperationalized policies.
across
• Provides direction during major security incidents and authorizes significant actions (e.g., full system shutdown, network isolation).
• Ensures resources (staff, budget, vendor support) are available to manage incidents effectively.

Authority

• Final authority on IT decisions impacting critical universityinstitutional systems and infrastructure.
processes.
• CanServes delegate operational authority toas the CISO,executive AVCresponse ofcoordinator IT Systems, Networking & IT Support or Incident Response Lead during activeany incidents.
true-positive
• Collaboratescybersecurity withincident. Executive Leadership (Chancellor’s Cabinet) and Legal Counsel to guide strategic response efforts.

5.2