Incident Response Plan
Effective Date: September 17, 2025
Revised Date: October 20, 2025
Responsible Office: Information Technology Services (ITS)
Contact: ITS Security Panel – security@AState.edu | ITS Help Desk – (870) 972-3033
1. Purpose
The purpose of this plan is to establish a structured Incident Response Plan (IRP) framework for identifying, responding to, and recovering from information security incidents at Arkansas State University. The plan ensures timely response, minimizes disruption to university operations, protects institutional data and assets, and supports compliance with applicable laws and regulations.
2. Scope
This IRP applies to all Information Technology Services (ITS) staff at Arkansas State University, including Security, Networking, Systems, Infrastructure, Hardware Services, Help Desk, and Card Center units. These groups are directly responsible for executing incident response actions as outlined in this plan.
The plan also extends to university leadership and supporting functions – including the CIO, CISO, Executive Leadership (Chancellor’s Cabinet), General Counsel, University Communications, and Risk Management – roles are defined in Section 5. Where applicable, University Police Department (UPD) and Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force) will be involved.
Third-party vendors and service providers with access to university systems or data are expected to cooperate fully with ITS, in incident investigation, containment, and remediation activities, and may be required to meet contractual or regulatory obligations (e.g., breach notifications, forensic reporting).
3. General Principles
- Incidents must be reported immediately (“If in doubt, report it”).
- Containment and evidence preservation precede recovery actions.
- All responses must follow chain-of-command authority as outlined in the Roles & Responsibilities section.
- Documentation and lessons learned are mandatory for every incident.
- Compliance with applicable laws (FERPA, HIPAA, GLBA, PCI, state/federal breach laws) is required.
4. Incident Response Plan (IRP) Procedures
The following steps are designed to ensure incidents are identified, assessed, contained, eradicated, and resolved in a timely and coordinated manner, while preserving evidence, maintaining compliance with regulatory requirements, and minimizing disruption to university operations.
- Report the incident immediately
Notify the ITS Security Panel (security@AState.edu), call ITS at (870) 972-3033, or after hours call (870) 253-8184. - Initial Notification & Logging
First panel member reached notifies appropriate staff using Teams/WebEx/phone (avoid email). Log initial details using the IT Security Incident Report (Appendix B). - Initial Assessment
Determine if the incident is active, impacted systems/data, and severity. Assess regulated data involvement or third-party impact. - Incident Categorization (Highest Applicable Level)
- Category 1 – Data Breach/Confidentiality Compromise: Unauthorized access/disclosure of sensitive or regulated data.
- Category 2 – System Integrity Compromise: Malicious activity undermining system trustworthiness or normal operation.
- Category 3 – Service Availability Disruption: Denial or degradation of critical IT services.
- Category 4 – Policy/Compliance Violation or Suspicious Activity: Misuse, non-compliance, or attempted attack requiring investigation.
- Legal & Compliance Notifications
If PII or regulated data may be involved, notify Legal Counsel. CIO (or designee) coordinates with Legal and University Communications on required notices (state, FERPA, HIPAA, PCI, etc.). - Law Enforcement & External Notifications
Notify UPD and FBI within 60 minutes if there is suspected criminal activity, data exfiltration, or significant loss. Document all notifications in Appendix B §6. - Containment & Evidence Preservation (Before Changes)
Isolate affected systems, preserve volatile and at-rest evidence, maintain chain of custody, and coordinate with UPD/FBI as required. Capture memory and volatile data before shutdown or rebuild. - Forensics & Root Cause
Conduct forensic analysis to identify cause, scope, dwell time, and affected assets. Preserve evidence, log all activity, and recommend preventive controls. - Eradication & Recovery (Authorization Required)
With CIO approval, rebuild/reimage affected systems, restore clean backups, enforce password resets, harden configurations, patch systems, and verify with EDR scans before full restoration. - Documentation
Document discovery, category, vector, indicators, actions, and residual risk in the incident record. - Evidence Retention
Retain logs, images, and records per policy and legal guidance. - Impact & Cost Assessment
Assess impact and estimate containment, recovery, and reputational costs. - Lessons Learned & Procedure Updates
Conduct review within 30 days of closure, update controls, assign owners, and track completion. - Communications & Follow-Up Plan
Define announcements, audiences, cadence, and responsible owner. Use approved templates from University Communications. - Closure
Complete the post-review checklist (Section 6) and submit to CIO or designee.
5. Roles, Responsibility, and Authority
5.1 Chief Information Officer (CIO)
- Responsibilities: Provides leadership, approves/enforces IRP, authorizes major actions, and ensures resources.
- Authority: Final authority on IT system decisions; may delegate during active incidents.
5.2 Chief Information Security Officer (CISO) / Director of IT Security / Incident Response Lead
- Responsibilities: Leads all phases of incident response, coordinates ITS teams, provides updates, and ensures post-incident reviews.
- Authority: Authorized to contain, escalate, and engage vendors for forensic or remediation support.
5.3 ITS Security Panel
- Responsibilities: Executes containment and recovery, preserves evidence, supports forensics, manages access resets, and recommends improvements.
- Authority: May act immediately to contain; restoration requires CISO approval.
5.4 Executive Leadership
- Responsibilities: Provides institutional direction, approves standards, and allocates emergency resources.
- Authority: Final authority on institutional risk and communications.
5.5 General Counsel (Legal)
- Responsibilities: Advises on legal/regulatory obligations, breach notifications, and compliance risk.
- Authority: Determines legal requirements and coordinates law enforcement engagement.
5.6 University Communications
- Responsibilities: Manages communication strategies, prepares statements, supports Help Desk messaging.
- Authority: Coordinates all media/public responses in collaboration with Executive Leadership and Legal.
5.7 Office of Risk Management
- Responsibilities: Coordinates insurance claims, continuity assessments, and risk mitigation planning.
- Authority: Initiates cyber insurance claims and requests supporting documentation.
5.8 University Police Department (UPD)
- Responsibilities: Primary law-enforcement liaison, maintains chain-of-custody, and coordinates with FBI.
- Authority: May restrict or seize evidence and authorize transfer to federal agencies.
5.9 Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force)
- Responsibilities: Advises on cybercrime cases, provides IOCs, and coordinates investigations.
- Authority: May request evidence/logs but does not supersede university containment or recovery.
6. Incident Post-Review Checklist
Following incident closure, ITS will lead a post-review with participation from relevant groups based on severity. The checklist includes:
- Policy Gaps
- Policy/Procedure Compliance
- Response Effectiveness
- Communication Timeliness
- Procedure Adequacy
- Remediation Actions
- Prevention of Recurrence
- Follow-Up Plan
- Risk Management Notification
7. Standards Review
This plan will be reviewed annually by the CIO, CISO, and ITS Security Panel or sooner if significant changes occur in technology, structure, or regulations.
Effective Date: September 17, 2025
Next Review Date: September 17, 2026
Version: 1.6
Appendix A – Security Panel Contact List
- Chris Boothman – 870-253-8184
- Jennifer Harrell – 870-253-9417
- Patrick Jeffrey – 870-680-2110
- Jacob Weaver
- Chase Roberson – 870-514-9553
- Himaja Balakrishnan – 870-897-6184
- Chris Doyle – 870-578-7838
- Heather Boothman – 870-930-8184
- Jake Yandell
- Shane Johnston
- Ken Anderson – 870-761-7059
- Eric Barnett
- Shivani Payyavula – 870-627-8495
Law Enforcement Contacts:
University Police Department (UPD): 870-972-2093 (24/7 Dispatch)
FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700
Jonesboro Police Department (via UPD): 870-935-5551
Appendix B – IT Security Incident Report
Date of Report: ____ Prepared By: ____ Incident Date: ____
1. Executive Summary
Brief overview of the incident, severity, and outcome.
2. Incident Overview & Key Timestamps
Identify severity (IRP category), affected assets/data, and critical timestamps (detection, containment, recovery).
3. Initial Indicators
Describe type, initial vector, and IOCs/IOAs.
4. Containment & Mitigation Actions
Document containment steps, approvals, and responsible parties.
5. Evidence Log & Chain of Custody
Record all evidence, handlers, and UPD/FBI contacts with case numbers.
6. Notifications & Communications
List all internal/external notifications with times and methods.
7. Root Cause Analysis
Summarize underlying vulnerabilities, process gaps, or third-party issues.
8. Timeline of Events
| Date | Event Description |
|---|---|
| ENTER DATE | ENTER TEXT |
| ENTER DATE | ENTER TEXT |
| ENTER DATE | ENTER TEXT |
9. Lessons Learned
Document what worked, what didn’t, and improvement areas.
10. Recommendations
List technical and procedural remediation items.
11. Review & Approval
Sign-offs by CIO/CISO and Risk Management (if applicable).
Appendix C – Responsibility Matrix
Purpose: This matrix provides a concise execution view for incident responders and approvers.
Legend: R = Responsible • A = Accountable • C = Consulted • I = Informed
| Activity / Phase (from IRP) | CIO | CISO | Panel | Legal | Comms | Exec | Risk | Vendor | UPD | FBI |
|---|---|---|---|---|---|---|---|---|---|---|
| Maintain IRP and contacts; resource enablement | A | R | C | C | C | C | C | C | I | I |
| Incident intake and initial notification/logging | I | A/R | R | I | I | I | I | I | I | I |
| Initial assessment and status (in progress? scope?) | I | A/R | R | C | I | I | I | I | I | I |
| Incident categorization (Cat 1–4) | I | A/R | C | C | I | I | I | I | I | I |
| Legal and compliance notifications decisioning | I | C | C | A/R | I | I | C | I | I | I |
| Law-enforcement trigger decision | C | A/R | C | C | I | I | I | I | C | C |
| External notifications (who/when) | I | C | C | A/R | C | I | I | I | R | R |
| Containment actions (isolate, disable, block) | I | A | R | I | I | I | I | C | C | C |
| Evidence preservation and chain of custody | I | A | R | C | I | I | C | C | A/R | C |
| Forensics and root cause (logs, imaging) | I | A | R | C | I | I | I | C | C | C |
| Eradication and recovery authorization | A | A/R | C | I | I | I | I | C | I | I |
| Eradication and recovery execution (rebuilds, resets, hardening, patches) | I | A | R | I | I | I | I | C | I | I |
| Validate clean state and return to service | A | R | R | I | I | I | I | C | I | I |
| Documentation (Incident Identification Form, evidence retention) | I | A | R | C | I | I | C | I | C | C |
| Impact and cost assessment | C | A/R | C | C | I | C | C | C | I | I |
| Communications and follow-up plan (audiences, cadence) | C | R | C | C | A/R | C | I | I | I | I |
| Lessons learned (≤ 30 days) and procedure updates | I | A/R | R | C | C | C | I | C | C | C |
| Annual plan review (or on significant change) | A | R | C | C | C | C | I | C | I | I |