Incident Response Plan

Effective Date: September 17, 2025
Revised Date: September 17, 2025
Responsible Offices: Information Technology Services (ITS)
Contact: ITS Security Panel – security@AState.edu | ITS Help Desk – (870) 972-3033

1. Purpose

The purpose of this Incident Response Plan (IRP) is to establish a structured framework for identifying, responding to, and recovering from information security incidents at Arkansas State University. The plan ensures timely response, minimizes disruption to university operations, protects institutional data and assets, and supports compliance with applicable laws and regulations.

2. Scope

This IRP applies to all Information Technology Services (ITS) staff at Arkansas State University, including Security, Networking, Systems, Infrastructure, Hardware Services, Help Desk, and Card Center units. The plan also includes university leadership and supporting functions (CIO, CISO, Executive Leadership, General Counsel, University Communications, and Risk Management), and establishes expectations for third-party vendors and service providers with access to university systems or data.

3. General Principles

Incidents must be reported immediately (“If in doubt, report it”).
Containment and evidence preservation precede recovery actions.
Responses follow the chain-of-command authority defined in Roles & Responsibilities.
Documentation and lessons learned are mandatory for every incident.
Compliance with applicable laws and regulations (e.g., FERPA, HIPAA, GLBA, PCI, state/federal breach laws) is required.

4. Incident Response Procedures

The steps below ensure incidents are identified, assessed, contained, eradicated, and resolved in a timely and coordinated manner, while preserving evidence, maintaining compliance, and minimizing disruption.

Report the Incident Immediately
Notify the ITS Security Panel (security@AState.edu), call the ITS front desk at (870) 972-3033, or after normal business hours call (870) 253-8184. If in doubt, report it.
Initial Notification & Logging
The first panel member reached notifies appropriate staff via Microsoft Teams/WebEx/phone (use email only as backup). Log initial details using the IT Security Incident Report (Appendix B).
Initial Assessment
Meet or confer to determine: Is the incident in progress? What data/systems are impacted? What is the impact (minimal/serious/critical)? Are regulated data involved? Are third-party vendors/cloud systems impacted?
Incident Categorization (Highest Applicable Level)
- Category 1 – Data Breach/Confidentiality Compromise: Unauthorized access, disclosure, or exfiltration of sensitive or regulated information.
- Category 2 – System Integrity Compromise: Malicious activity undermining trustworthiness or normal function (e.g., ransomware, malware, defacement).
- Category 3 – Service Availability Disruption: Denial or degradation of critical IT services (e.g., DDoS, LMS/email outage).
- Category 4 – Policy/Compliance Violation or Suspicious Activity: Misuse/attempts requiring investigation (e.g., phishing attempts, repeated failed logins). Routine Cat 4 events do not require full IRP invocation but must be documented and reported to the Security Panel. Escalate/re-classify if impact increases.
Legal & Compliance Notifications
If PII or regulated data may be involved, notify University Legal Counsel for statutory guidance. The CIO (or designee) coordinates with Legal and University Communications for required notifications.
External Notifications
Determine whether to notify non-Panel members (UPD, Executive Council, University Communications Director) and relevant external parties/law enforcement as needed.
Containment & Evidence Preservation (Before Changes)
Isolate to limit spread. Preserve volatile and at-rest evidence, maintaining chain of custody; capture memory/volatile data when feasible. Avoid system changes beyond necessary containment without forensics and executive approval.
Forensics & Root Cause
Authorized team members conduct log review, sensor/IDS analysis, imaging, and interviews to determine scope, dwell time, and affected assets. Log all forensic activity; preserve evidence; recommend preventive changes. Engage approved vendors as needed.
Eradication & Recovery (Authorization Required)
With CIO (or designee) approval: rebuild/re-image systems, restore from clean backups, reset credentials, harden configurations, patch, activate EDR/IDS, and verify logging to SIEM. Validate a clean state before full service restoration.
Documentation
Record discovery method, category, initial vector, indicators (IPs, accounts, domains, IOCs/TTPs), actions and owners, effectiveness, and residual risk in the incident record (Appendix B form).
Evidence Retention
Retain logs, emails, images, and other records per university retention policy and legal guidance.
Impact & Cost Assessment
Assess organizational impact and estimate direct/indirect costs (containment, recovery, vendor services, productivity, reputation, academic disruption).
Lessons Learned & Procedure Updates
Within 30 days of closure, conduct a post-incident review. Update procedures, controls, and training. Track actions to owners with due dates.
Communications & Follow-Up Plan
Define audiences, cadence, timeline, and owners. Use approved templates from University Communications and retain copies in the incident record.
Closure
Complete the Incident Post-Review Checklist (Section 6) and file with the CIO (or designee). Ensure all remediation items are tracked to completion.

5. Roles, Responsibility, and Authority

5.1 Chief Information Officer (CIO)

Responsibilities: Provides overall leadership; approves/enforces the IRP; authorizes significant actions; ensures resources.
Authority: Final authority on IT decisions impacting critical systems; may delegate operational authority during incidents; collaborates with Executive Leadership and Legal.

5.2 Chief Information Security Officer (CISO) / Incident Response Lead

Responsibilities: Leads detection, assessment, containment, eradication, recovery, and closure; coordinates ITS teams; provides status updates; ensures after-action review.
Authority: Initiates containment; escalates to CIO/Legal/Comms/law enforcement; requests vendor forensics support.

5.3 ITS Security Panel (Security, Networking, Systems, Hardware Services, Help Desk, Card Center)

Responsibilities: Operates under CISO/IR Lead; coordinates containment, eradication, recovery; preserves evidence; provides data; validates clean state; manages identity/access actions; recommends improvements.
Authority: Executes immediate containment and recovery actions; does not restore/close incidents without CISO/IR Lead approval.

5.4 Executive Leadership (Chancellor’s Cabinet)

Responsibilities: Provides institutional leadership for incidents affecting operations; reviews/approves significant standards; allocates emergency resources.
Authority: Final authority on institutional risk and operational decisions; directs university-wide communications.

5.5 General Counsel (Legal)

Responsibilities: Advises on legal/regulatory obligations; determines breach notification requirements; provides legal risk assessments.
Authority: Determines legal requirements for handling breaches/notifications; coordinates with law enforcement as needed.

5.6 University Communications/Marketing

Responsibilities: Manages internal/external communications; prepares public statements with Executive Leadership and Legal; supports Help Desk messaging.
Authority: Coordinates media responses and public statements.

5.7 Office of Risk Management

Responsibilities: Coordinates business continuity assessments; manages cyber liability insurance claims; advises on risk mitigation and recovery.
Authority: Initiates cyber insurance claims with ITS and Legal; requests supporting documentation; advises Executive Leadership.

6. Incident Post-Review Checklist

Following the closure of any incident, ITS must complete a post-review process to capture lessons learned, identify improvements, and ensure preventive measures are implemented.

While ITS, specifically the Chief Information Security Officer (CISO), is ultimately responsible for formalizing any final documentation established, the post-mortem review will be initiated and coordinated by ITS in conjunction with, at a minimum, the Security Panel. Depending on the severity and impact of the incident, feedback and input from other constituent groups listed in Section 5 (Notifications & Communications) will also be incorporated as appropriate.

The following checklist should be addressed and documented for every incident:

Policy gaps and needed policies
Policy/procedure compliance issues and improvements
Response effectiveness and process improvements
Communication timeliness and completeness
Procedure adequacy vs. incident scope
Remediation actions implemented
Prevention of recurrence
Follow-up plan, owners, and timelines
Risk Management notification/assessment (if applicable)

7. Standards Review

This plan will be reviewed annually by the CIO, CISO, and ITS Security Panel, or sooner if significant changes occur to technology, organizational structure, or applicable regulations.

Effective Date: September 17, 2025
Next Review Date: September 17, 2026
Version: 1.5

Appendix A – Security Panel Contact List

Chris Boothman – 870-253-8184
Jennifer Harrell – 870-253-9417
Patrick Jeffrey – 870-680-2110
Jacob Weaver
Chase Roberson – 870-514-9553
Himaja Balakrishnan – 870-897-6184
Chris Doyle – 870-578-7838
Heather Boothman – 870-930-8184
Jake Yandell
Shane Johnston
Ken Anderson – 870-761-7059
Eric Barnett
Shivani Payyavula – 870-627-8495

Appendix B – IT Security Incident Report (Form)

Download Security Incident Reporting Form (092825).docx

B.1 Header

Date of Report: ____ Prepared By: ____ Incident Date: ____

B.2 Executive Summary

Brief overview of the incident, severity, and outcome.

B.3 Incident Overview & Key Timestamps

Category (IRP 1–4): ____
Regulated Data Involved: ____
Affected Assets/Users/Depts: ____
Vendors/Systems Involved: ____
Operational Disruption (Minimal/Serious/Critical): ____
Detection Date/Time: ____
Restoration Date/Time: ____

Synopsis (if applicable)

B.4 Initial Indicators

Type/Initial Vector (e.g., DoS, Unauthorized Use, Phishing, Malware, Ransomware): ____
Indicators of Compromise (IOCs): ____
Indicators of Attack (IOAs): ____

B.5 Containment & Mitigation Actions

Actions taken, by whom, and approvals.

B.6 Evidence Log & Chain of Custody

Record collected evidence, handlers, and transfers.

B.7 Notification & Communications

Document internal/external notifications (who, when, method).

B.8 Root Cause Analysis

Underlying issue (vulnerability, process gap, human error, vendor failure):

B.9 Timeline of Events

Date	Event Description
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT

B.10 Lessons Learned

What worked, what didn’t, gaps identified.

B.11 Recommendations

Technical remediations and process/training updates.

B.12 Review & Approval

Final review and approvals (e.g., CIO/CISO, Risk Management if applicable).

Appendix C – Responsibility Matrix

Legend: R = Responsible • A = Accountable • C = Consulted • I = Informed

Roles (columns): CIO (or designee) = CIO; CISO / Incident Response Lead = CISO; ITS Security Panel = Panel; General Counsel = Legal; University Communications = Comms; Executive Leadership = Exec; Risk Management = Risk; Approved Third-Party Vendors = Vendor

Activity / Phase (from IRP)	CIO	CISO	Panel	Legal	Comms	Exec	Risk	Vendor
Maintain IRP and contacts; resource enablement	A	R	C	C	C	C	C	C
Incident intake & initial notification/logging	I	A/R	R	I	I	I	I	I
Initial assessment and status (in progress? scope?)	I	A/R	R	C	I	I	I	I
Incident categorization (Cat 1–4)	I	A/R	C	C	I	I	I	I
Legal & compliance notifications decisioning	I	C	C	A/R	I	I	C	I
External notifications (who/when)	I	C	C	A/R	C	I	I	I
Containment actions (isolate, disable, block)	I	A	R	I	I	I	I	C
Evidence preservation & chain of custody	I	A	R	C	I	I	C	C
Forensics & root cause (logs, imaging)	I	A	R	C	I	I	I	C
Eradication & recovery authorization	A	A/R	C	I	I	I	I	C
Eradication & recovery execution	I	A	R	I	I	I	I	C
Validate clean state & return to service	A	R	R	I	I	I	I	C
Documentation & evidence retention	I	A	R	C	I	I	C	I
Impact & cost assessment	C	A/R	C	C	I	C	C	C
Comms & follow-up plan (audiences, cadence)	C	R	C	C	A/R	C	I	I
Lessons learned (≤30 days) & updates	I	A/R	R	C	C	C	I	C
Annual plan review (or on significant change)	A	R	C	C	C	C	I	C