Incident Response Plan

Effective Date: September 17, 2025
Revised Date: SeptemberOctober 17,20, 2025
Responsible Offices:Office: Information Technology Services (ITS)
Contact: ITS Security Panel – security@AState.edu  |  ITS Help Desk – (870) 972-3033

1. Purpose

The purpose of this Incident Response Plan (IRP)plan is to establish a structured Incident Response Plan (IRP) framework for identifying, responding to, and recovering from information security incidents at Arkansas State University. The plan ensures timely response, minimizes disruption to university operations, protects institutional data and assets, and supports compliance with applicable laws and regulations.

---

2. Scope

This IRP applies to all Information Technology Services (ITS) staff at Arkansas State University, including Security, Networking, Systems, Infrastructure, Hardware Services, Help Desk, and Card Center units. These groups are directly responsible for executing incident response actions as outlined in this plan.

The plan also includesextends to university leadership and supporting functions (– including the CIO, CISO, Executive Leadership,Leadership (Chancellor’s Cabinet), General Counsel, University Communications, and Risk Management),Management – roles are defined in Section 5. Where applicable, University Police Department (UPD) and establishesFederal expectationsBureau forof third-Investigation (FBI – Jonesboro Cyber Task Force) will be involved.

Third-party vendors and service providers with access to university systems or data.data are expected to cooperate fully with ITS, in incident investigation, containment, and remediation activities, and may be required to meet contractual or regulatory obligations (e.g., breach notifications, forensic reporting).

---

3. General Principles

• Incidents must be reported immediately (“If in doubt, report it”).
• Containment and evidence preservation precede recovery actions.
• ResponsesAll responses must follow the chain-of-command authority definedas outlined in the Roles & Responsibilities.Responsibilities section.
• Documentation and lessons learned are mandatory for every incident.
• Compliance with applicable laws and regulations (e.g., FERPA, HIPAA, GLBA, PCI, state/federal breach laws) is required.

---

4. Incident Response Plan (IRP) Procedures

The following steps beloware designed to ensure incidents are identified, assessed, contained, eradicated, and resolved in a timely and coordinated manner, while preserving evidence, maintaining compliance,compliance with regulatory requirements, and minimizing disruption.disruption to university operations.

1. Report the Incidentincident Immediatelyimmediately

   
   Notify the ITS Security Panel (security@AState.edu), call the ITS front desk at (870) 972-3033, or after normal business hours call (870) 253-8184. If in doubt, report it.

2. Initial Notification & Logging

   The first
   First panel member reached notifies appropriate staff via Microsoftusing Teams/WebEx/phone (useavoid email only as backup)email). Log initial details using the IT Security Incident Report (Appendix B).

3. Initial Assessment
   Determine

   Meet or confer to determine: Isif the incident in progress? What data/systems are impacted? What is theactive, impactimpacted (minimal/serious/critical)?systems/data, Areand severity. Assess regulated data involved?involvement Areor third-party vendors/cloud systems impacted?

   impact.
4. Incident Categorization (Highest Applicable Level)
   • Category 1 – Data Breach/Confidentiality Compromise: Unauthorized access, disclosure, or exfiltrationaccess/disclosure of sensitive or regulated information.data.
   • Category 2 – System Integrity Compromise: Malicious activity undermining system trustworthiness or normal function (e.g., ransomware, malware, defacement).operation.
   • Category 3 – Service Availability Disruption: Denial or degradation of critical IT services (e.g., DDoS, LMS/email outage).services.
   • Category 4 – Policy/Compliance Violation or Suspicious Activity: Misuse/attemptsMisuse, non-compliance, or attempted attack requiring investigation (e.g., phishing attempts, repeated failed logins). Routine Cat 4 events do not require full IRP invocation but must be documented and reported to the Security Panel. Escalate/re-classify if impact increases.investigation.
5. Legal & Compliance Notifications

   
   If PII or regulated data may be involved, notify University Legal Counsel for statutory guidance. TheCounsel. CIO (or designee) coordinates with Legal and University Communications foron required notifications.

   notices (state, FERPA, HIPAA, PCI, etc.).
6. Law Enforcement & External Notifications
   Notify

   Determine whether to notify non-Panel members (UPD, Executive Council, University Communications Director)UPD and relevantFBI externalwithin parties/law60 enforcementminutes asif needed.

   there is suspected criminal activity, data exfiltration, or significant loss. Document all notifications in Appendix B §6.
7. Containment & Evidence Preservation (Before Changes)

   
   Isolate toaffected limitsystems, spread. Preservepreserve volatile and at-rest evidence, maintainingmaintain chain of custody;custody, captureand memory/coordinate with UPD/FBI as required. Capture memory and volatile data whenbefore feasible.shutdown Avoidor system changes beyond necessary containment without forensics and executive approval.

   rebuild.
8. Forensics & Root Cause
   Conduct

   Authorizedforensic team members conduct log review, sensor/IDS analysis, imaging, and interviewsanalysis to determineidentify cause, scope, dwell time, and affected assets. LogPreserve evidence, log all forensicactivity, activity; preserve evidence;and recommend preventive changes. Engage approved vendors as needed.

   controls.
9. Eradication & Recovery (Authorization Required)

   
   With CIO (or designee) approval:approval, rebuild/re-imagereimage affected systems, restore from clean backups, resetenforce credentials,password resets, harden configurations, patch,patch activate EDR/IDS,systems, and verify loggingwith toEDR SIEM. Validate a clean statescans before full service restoration.

10. Documentation
    Document

    Record discovery method,discovery, category, initial vector, indicatorsindicators, (IPs, accounts, domains, IOCs/TTPs), actions and owners, effectiveness,actions, and residual risk in the incident record (Appendix B form).

    record.
11. Evidence Retention

    
    Retain logs, emails, images, and other records per university retention policy and legal guidance.

12. Impact & Cost Assessment

    
    Assess organizational impact and estimate direct/indirect costs (containment, recovery, vendorand services,reputational productivity, reputation, academic disruption).

    costs.
13. Lessons Learned & Procedure Updates
    Conduct

    Withinreview within 30 days of closure, conduct a post-incident review. Update procedures,update controls, assign owners, and training.track Track actions to owners with due dates.

    completion.
14. Communications & Follow-Up Plan
    Define

    Defineannouncements, audiences, cadence, timeline, and owners.responsible owner. Use approved templates from University Communications and retain copies in the incident record.

    Communications.
15. Closure

    
    Complete the Incidentpost-review Post-Review Checklistchecklist (Section 6) and filesubmit with theto CIO (or designee). Ensure all remediation items are tracked to completion.

    designee.

---

5. Roles, Responsibility, and Authority

5.1 Chief Information Officer (CIO)

• Responsibilities: Provides overall leadership;leadership, approves/enforces the IRP;IRP, authorizes significantmajor actions;actions, and ensures resources.
• Authority: Final authority on IT decisionssystem impacting critical systems;decisions; may delegate operational authority during incidents;active collaborates with Executive Leadership and Legal.incidents.

5.2 Chief Information Security Officer (CISO) / Director of IT Security / Incident Response Lead

• Responsibilities: Leads detection,all assessment,phases containment,of eradication,incident recovery, and closure;response, coordinates ITS teams;teams, provides statusupdates, updates;and ensures after-actionpost-incident review.reviews.
• Authority: Initiates containment; escalatesAuthorized to CIO/Legal/Comms/lawcontain, enforcement;escalate, requestsand vendorengage forensicsvendors for forensic or remediation support.

5.3 ITS Security Panel (Security, Networking, Systems, Hardware Services, Help Desk, Card Center)

• Responsibilities: OperatesExecutes undercontainment CISO/IRand Lead; coordinates containment, eradication, recovery;recovery, preserves evidence;evidence, providessupports data; validates clean state;forensics, manages identity/access actions;resets, and recommends improvements.
• Authority: ExecutesMay immediateact containmentimmediately andto recoverycontain; actions;restoration doesrequires not restore/close incidents without CISO/IR LeadCISO approval.

5.4 Executive Leadership (Chancellor’s Cabinet)

• Responsibilities: Provides institutional leadershipdirection, for incidents affecting operations; reviews/approves significantstandards, standards;and allocates emergency resources.
• Authority: Final authority on institutional risk and operational decisions; directs university-wide communications.

5.5 General Counsel (Legal)

• Responsibilities: Advises on legal/regulatory obligations; determinesobligations, breach notificationnotifications, requirements;and providescompliance legal risk assessments.risk.
• Authority: Determines legal requirements for handling breaches/notifications;and coordinates with law enforcement as needed.engagement.

5.6 University Communications/MarketingCommunications

• Responsibilities: Manages internal/externalcommunication communications;strategies, prepares public statements with Executive Leadership and Legal;statements, supports Help Desk messaging.
• Authority: Coordinates mediaall media/public responses in collaboration with Executive Leadership and public statements.Legal.

5.7 Office of Risk Management

• Responsibilities: Coordinates businessinsurance claims, continuity assessments;assessments, manages cyber liability insurance claims; advises onand risk mitigation and recovery.planning.
• Authority: Initiates cyber insurance claims with ITS and Legal; requests supporting documentation;documentation.
advises

Executive

5.8 Leadership.University Police Department (UPD)

• Responsibilities: Primary law-enforcement liaison, maintains chain-of-custody, and coordinates with FBI.
• Authority: May restrict or seize evidence and authorize transfer to federal agencies.

5.9 Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force)

• Responsibilities: Advises on cybercrime cases, provides IOCs, and coordinates investigations.
• Authority: May request evidence/logs but does not supersede university containment or recovery.

---

6. Incident Post-Review Checklist

Following theincident closure of any incident,closure, ITS mustwill completelead a post-review processwith toparticipation capturefrom lessonsrelevant learned,groups identify improvements, and ensure preventive measures are implemented.

While ITS, specifically the Chief Information Security Officer (CISO), is ultimately responsible for formalizing any final documentation established, the post-mortem review will be initiated and coordinated by ITS in conjunction with, at a minimum, the Security Panel. Dependingbased on theseverity. severity and impact of the incident, feedback and input from other constituent groups listed in Section 5 (Notifications & Communications) will also be incorporated as appropriate.

The following checklist should be addressed and documented for every incident:includes:

• Policy gaps and needed policiesGaps
• Policy/procedureProcedure compliance issues and improvementsCompliance
• Response effectiveness and process improvementsEffectiveness
• Communication timeliness and completenessTimeliness
• Procedure adequacy vs. incident scopeAdequacy
• Remediation actions implementedActions
• Prevention of recurrenceRecurrence
• Follow-upUp plan, owners, and timelinesPlan
• Risk Management notification/assessment (if applicable)Notification

---

7. Standards Review

This plan will be reviewed annually by the CIO, CISO, and ITS Security Panel,Panel or sooner if significant changes occur toin technology, organizational structure, or applicable regulations.

Effective Date: September 17, 2025
Next Review Date: September 17, 2026
Version: 1.56

---

Appendix A – Security Panel Contact List

• Chris Boothman – 870-253-8184
• Jennifer Harrell – 870-253-9417
• Patrick Jeffrey – 870-680-2110
• Jacob Weaver
• Chase Roberson – 870-514-9553
• Himaja Balakrishnan – 870-897-6184
• Chris Doyle – 870-578-7838
• Heather Boothman – 870-930-8184
• Jake Yandell
• Shane Johnston
• Ken Anderson – 870-761-7059
• Eric Barnett
• Shivani Payyavula – 870-627-8495

Law Enforcement Contacts:
University Police Department (UPD): 870-972-2093 (24/7 Dispatch)
FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700
Jonesboro Police Department (via UPD): 870-935-5551

---

Appendix B – IT Security Incident Report (Form)

Download Security Incident Reporting Form (092825).docx

B.1 Header

Date of Report: ____    Prepared By: ____    Incident Date: ____

B.21. Executive Summary

Brief overview of the incident, severity, and outcome.

B.32. Incident Overview & Key Timestamps

Identify

• Categoryseverity (IRP 1–4):category), ____
affected
• Regulatedassets/data, Dataand Involved:critical ____
• Affected Assets/Users/Depts: ____
• Vendors/Systems Involved: ____
• Operational Disruptiontimestamps (Minimal/Serious/Critical):detection, ____
containment,
• Detection Date/Time: ____
• Restoration Date/Time: ____

Synopsis (if applicable)recovery).

B.43. Initial Indicators

Describe

• Type/Initialtype, Vectorinitial (e.g.,vector, DoS,and Unauthorized Use, Phishing, Malware, Ransomware): ____
• Indicators of Compromise (IOCs): ____
• Indicators of Attack (IOAs): ____

IOCs/IOAs.

B.54. Containment & Mitigation Actions

ActionsDocument taken,containment bysteps, whom,approvals, and approvals.responsible parties.

B.65. Evidence Log & Chain of Custody

Record collectedall evidence, handlers, and transfers.UPD/FBI contacts with case numbers.

B.76. NotificationNotifications & Communications

DocumentList all internal/external notifications (who,with when,times method).and methods.

B.87. Root Cause Analysis

UnderlyingSummarize issueunderlying (vulnerability,vulnerabilities, process gap,gaps, humanor error,third-party vendor failure):issues.

B.98. Timeline of Events

Date	Event Description
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT
ENTER DATE	ENTER TEXT

B.109. Lessons Learned

WhatDocument what worked, what didn’t, gapsand identified.improvement areas.

B.1110. Recommendations

TechnicalList remediationstechnical and process/trainingprocedural updates.remediation items.

B.1211. Review & Approval

FinalSign-offs reviewby CIO/CISO and approvals (e.g., CIO/CISO, Risk Management (if applicable).

---

Appendix C – Responsibility Matrix

Purpose: This matrix provides a concise execution view for incident responders and approvers.

Legend: R = Responsible  •  A = Accountable  •  C = Consulted  •  I = Informed

Roles (columns): CIO (or designee) = CIO; CISO / Incident Response Lead = CISO; ITS Security Panel = Panel; General Counsel = Legal; University Communications = Comms; Executive Leadership = Exec; Risk Management = Risk; Approved Third-Party Vendors = Vendor

Activity / Phase (from IRP)	CIO	CISO	Panel	Legal	Comms	Exec	Risk	Vendor	UPD	FBI
Maintain IRP and contacts; resource enablement	A	R	C	C	C	C	C	C	I	I
Incident intake &and initial notification/logging	I	A/R	R	I	I	I	I	I	I	I
Initial assessment and status (in progress? scope?)	I	A/R	R	C	I	I	I	I	I	I
Incident categorization (Cat 1–4)	I	A/R	C	C	I	I	I	I	I	I
Legal &and compliance notifications decisioning	I	C	C	A/R	I	I	C	I	I	I
Law-enforcement trigger decision	C	A/R	C	C	I	I	I	I	C	C
External notifications (who/when)	I	C	C	A/R	C	I	I	I	R	R
Containment actions (isolate, disable, block)	I	A	R	I	I	I	I	C	C	C
Evidence preservation &and chain of custody	I	A	R	C	I	I	C	C	A/R	C
Forensics &and root cause (logs, imaging)	I	A	R	C	I	I	I	C	C	C
Eradication &and recovery authorization	A	A/R	C	I	I	I	I	C	I	I
Eradication &and recovery execution (rebuilds, resets, hardening, patches)	I	A	R	I	I	I	I	C	I	I
Validate clean state &and return to service	A	R	R	I	I	I	I	C	I	I
Documentation &(Incident Identification Form, evidence retentionretention)	I	A	R	C	I	I	C	I	C	C
Impact &and cost assessment	C	A/R	C	C	I	C	C	C	I	I
CommsCommunications &and follow-up plan (audiences, cadence)	C	R	C	C	A/R	C	I	I	I	I
Lessons learned (≤ 30 days) &and procedure updates	I	A/R	R	C	C	C	I	C	C	C
Annual plan review (or on significant change)	A	R	C	C	C	C	I	C	I	I