Skip to main content

Incident Response Plan

Effective Date: September 17, 2025
Revised Date: October 20, 2025
Responsible Office: Information Technology Services (ITS)
Contact: ITS Security Panel – security@AState.edu | ITS Help Desk – (870) 972-3033

1. Purpose

The purpose of this plan is to establish a structured Incident Response Plan (IRP) framework for identifying, responding to, and recovering from information security incidents at Arkansas State University. The plan ensures timely response, minimizes disruption to university operations, protects institutional data and assets, and supports compliance with applicable laws and regulations.

2. Scope

This IRP applies to all Information Technology Services (ITS) staff at Arkansas State University, including Security, Networking, Systems, Infrastructure, Hardware Services, Help Desk, and Card Center units. These groups are directly responsible for executing incident response actions as outlined in this plan.

The plan also extends to university leadership and supporting functions – including the CIO, CISO, Executive Leadership (Chancellor’s Cabinet), General Counsel, University Communications, and Risk Management – roles are defined in Section 5. Where applicable, University Police Department (UPD) and Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force) will be involved.

Third-party vendors and service providers with access to university systems or data are expected to cooperate fully with ITS, in incident investigation, containment, and remediation activities, and may be required to meet contractual or regulatory obligations (e.g., breach notifications, forensic reporting).

3. General Principles

ITS has the following general principles related to this IRP:

  • Incidents must be reported immediately (“If in doubt, report it”).
  • Containment and evidence preservation precede recovery actions.
  • All responses must follow chain-of-command authority as outlined in the Roles & Responsibilities section.
  • Documentation and lessons learned are mandatory for every incident.
  • Compliance with applicable laws (FERPA, HIPAA, GLBA, PCI, state/federal breach laws) is required.

4. Incident Response Plan (IRP) Procedures

The following steps are designed to ensure incidents are identified, assessed, contained, eradicated, and resolved in a timely and coordinated manner, while preserving evidence, maintaining compliance with regulatory requirements, and minimizing disruption to university operations.

  1. Report the incident immediatelyimmediately.

    The person who discovers the incident will notify the ITS Security Panel (see Appendix A for contacts), email security@astate.edu, contact the ITS front desk at 870-972-3033, or after normal business hours call 870-253-8184. If in doubt, report it.

  2. Initial notification & logging (by first panel member reached).

    Notify the ITS Security Panel (security@AState.edu), call ITS at (870) 972-3033, or after hours call (870) 253-8184.

  3. Initial Notification & Logging
    First panel member reached notifiesand appropriate staff using WebEx/Teams/WebEx/phonephone; use email only as backup (avoidemail email)may be part of the compromise). Log initial details usingon the IT Security Incident Report (Appendix B).

  4. Initial Assessmentassessment (by Security Panel).
    Determine

    Meet or confer via phone, Microsoft Teams, or WebEx to evaluate status and immediate needs addressing the following questions to gain further insight into the incident:

    • Is the incident still in progress? If yes, take immediate containment action to disconnect or isolate the incident.
    • What data/property is threatened/compromised, and how critical is it?
    • What is/was the impact if the incidentattack issucceeds active,or impactedhas systems/data,succeeded (minimal, serious, or critical)
    • What system(s) are targeted, and severity.where Assessare regulatedthey located (physical/network)?
    • Are regulated/sensitive data involvementinvolved or(e.g. FERPA, HIPAA, GLBA, PCI, sponsored research)?
    • Are third-party impact.vendors/cloud systems impacted? (open vendor ticket/escalation if so)

  5. IncidentCategorize Categorizationthe incident (Highesthighest Applicableapplicable Level)level).

    The incident will be categorized into the highest applicable level of one of the following categories:

    • Category 1one – (Data Breach/Confidentiality Compromise:Compromise) 
      Unauthorized access/disclosureaccess, disclosure, or exfiltration of sensitive or regulated data.information (FERPA, HIPAA, GLBA, PCI, PII, research data).
      Examples: database intrusion, stolen credentials used to access Banner, exposure of SSNs in files.
    • Category 2two – (System Integrity Compromise:Compromise) 
      Malicious activity underminingthat systemundermines the trustworthiness or normal operation.function of university systems.
      Examples: ransomware, malware infection, website defacement, rootkit installation.
    • Category 3three – (Service Availability Disruption:Disruption) 
      Denial or degradation of critical IT services.
      Examples: DDoS attack on campus internet, LMS/email outage, server crash from attack.
    • Category 4four – (Policy/Compliance Violation or Suspicious Activity:Activity)
      Incidents Misuse,that do not rise to the level of breach/system compromise, but indicate misuse, non-compliance, or attempted attack requiring investigation.
      Examples: phishing attempts, repeated failed logins, unauthorized software installation, use of unapproved cloud storage.

       


      Routine Category Four events       (e.g., single compromised accounts, isolated phishing attempts, or minor compliance violations) do not require a full invocation of the Incident Response Plan (IRP).

      These events should still be:

      • Documented via an Incident Response Form.
      • Reported to the Security Panel for awareness, tracking, and trend analysis.


      Escalation criteria:       If the incident escalates in scale, impact, or regulatory risk the incident should be re-classified into the highest applicable category (Category 1 - 3) and the full IRP should be triggered.

     

  6. Legal & Compliancecompliance Notificationsnotifications.

    If PII or regulated data may be involved, notify University Legal Counsel.Counsel for statutory notification guidance. The CIO (or CIO’s designee) coordinateswill coordinate with Legal and University Communications onfor requiredmandatory notices (state,state legislative audit/federal law; FERPA, HIPAA, PCI,PCI; etc.)GDPR if applicable).

  7. Law Enforcement & External Notificationsnotifications.

    The Incident Response Lead, in consultation with the CIO and Legal Counsel, must determine whether an incident meets the criteria for mandatory law-enforcement notification.

    Notify law enforcement (UPD and FBIFBI) within 60 minutes ifwhen thereany isof the following apply:

    • Confirmed or suspected criminal activity,activity (unauthorized intrusion, data exfiltration, extortion, or significantransomware).
      • loss.
    • Significant Documentsensitive allor regulated data exposure (FERPA, HIPAA, GLBA, PCI, CJIS, PII).
    • Evidence of credential theft or account takeover at scale.
    • Significant financial loss or fraud (e.g., business email compromise).
    • Threats to life/safety or potential national-security implications.

    Contact order (phone preferred; do not use email):

    • University Police Department (UPD): 870-972-2093 – establish a campus case number, coordinate chain-of-custody, and initiate contact with local/federal agencies.
    • FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700 — engage for coordination on active intrusion, ransomware, or data-theft cases.
    • Jonesboro Police Department (as directed by UPD): 870-935-5551.

    All notifications must be documented in Appendix BB, §6.Section 6 (Notification & Communications).

  8. Containment & Evidence Preservation (Before Changes).
    Isolate affected

    Based systems,on preservethe assessment, follow the appropriate procedure/runbook (see Incident Response Procedures/Contact List). Prioritize isolation/containment to limit spread.

    • Preserve evidence (volatile and at-restrest) evidence,and maintain chain of custody,custody with UPD if needed.
    • Capture memory/volatile data where feasible before shutdown/rebuild.
    • Do not alter systems beyond what is required for containment without forensics and executive leadership approval.

    When law enforcement involvement is triggered; the CISO/Incident Lead must coordinate with UPD/UPD to establish an evidence chain-of-custody. All evidence transfers to UPD or FBI asmust required.be Capturelogged memory(see Appendix B, §5), sealed, and volatilehashed datafor beforeintegrity shutdownverification.

    or rebuild.
  9. Forensics &and Root Cause
    Conduct

    Authorized team members will use forensic analysistechniques (log review, sensor/IDS data, imaging, interviews) to identifydetermine cause, scope, dwell time, and affected assets. Preserve evidence, logLog all activity,forensics andactivity; recommendpreserve evidence per chain-of-custody requirements. Recommend specific preventive controls.changes. Approved third-party vendors may be utilized to support forensic analysis.

  10. Eradication & Recovery (Authorization Required)

    With CIO (or CIO’s designee) approval, rebuild/reimageproceed to eradication and recovery:

    • Rebuild/re-image affected systems,systems and restore data from clean backups,backups enforceas necessary.
    • Require password resets,resets hardenwhere configurations,credential patchcompromise systems,is possible.
    • Harden systems (remove/disable unused services).
    • Apply current patches/updates.
    • Ensure real-time malware protection/EDR and verifynetwork withIDS are active.
    • Verify logging is enabled at appropriate levels and forwarding to central SIEM.
    • Validate clean state (scans, EDR scanshealth, integrity checks) before returning to full restoration.service.

  11. Documentation
    Document discovery,

    The category,following vector,shall indicators,be actions,documented and filed with the CIO (or CIO’s designee) (see Incident Identification form):

    • How the incident was discovered.
    • The category of the incident.
    • Initial attack vector (e.g., email, web, RDP, vendor) - How the incident occurred, whether through email, firewall, etc.
    • Origin indicators (IPs, accounts, domains, TTPs, IOCs) - Where the attack came from, such as IP addresses and other related information about the attacker.
    • Response actions taken and by whom.
    • Effectiveness of actions and residual riskrisk.

      • in
    the incident record.
  12. Evidence Retention
    Retain

    Copies of logs, emails, images, and other records will be retained as evidence for as long as necessary to complete investigation and any legal proceedings, including appeals, per Arkansas State University’s records retention policy and legal guidance.

  13. Impact & Cost Assessment

    Assess organizational impact and estimate direct and indirect costs (containment, recovery, andvendor services, lost productivity, reputational costs.impact, student/faculty disruption).

  14. Lessons Learned & Procedure Updates
    Conduct review within

    Within 30 days of incident closure, updateconduct a formal post-incident review. Update procedures, controls, assignand owners,training. Track and trackassign completion.actions to owners with due dates.

  15. Communications & Follow-Up Plan
    Define

    Determine required announcements, audiences,audiences cadence,(executives, IT staff, campus community), frequency, timeline, and responsible owner. Use approved communications templates fromas Universityprovided Communications.by Chief Communications Officer and retain copies in the incident record.

  16. Closure
    Complete

    Review the post-reviewIncident checklistPost-Review Checklist (Section 6) and submitfile with the CIO (or CIO’s designee). Ensure all assigned remediation items are tracked to CIOcompletion.

    or designee.

5. Roles, Responsibility, and Authority

5.1 Chief Information Officer (CIO)
  • Responsibilities: Provides leadership, approves/enforces IRP, authorizes major actions, and ensures resources.
  • Authority: Final authority on IT system decisions; may delegate during active incidents.
5.2 Chief Information Security Officer (CISO) / Director of IT Security / Incident Response Lead
  • Responsibilities: Leads all phases of incident response, coordinates ITS teams, provides updates, and ensures post-incident reviews.
  • Authority: Authorized to contain, escalate, and engage vendors for forensic or remediation support.
5.3 ITS Security Panel
  • Responsibilities: Executes containment and recovery, preserves evidence, supports forensics, manages access resets, and recommends improvements.
  • Authority: May act immediately to contain; restoration requires CISO approval.
5.4 Executive Leadership
  • Responsibilities: Provides institutional direction, approves standards, and allocates emergency resources.
  • Authority: Final authority on institutional risk and communications.
5.5 General Counsel (Legal)
  • Responsibilities: Advises on legal/regulatory obligations, breach notifications, and compliance risk.
  • Authority: Determines legal requirements and coordinates law enforcement engagement.
5.6 University Communications
  • Responsibilities: Manages communication strategies, prepares statements, supports Help Desk messaging.
  • Authority: Coordinates all media/public responses in collaboration with Executive Leadership and Legal.
5.7 Office of Risk Management
  • Responsibilities: Coordinates insurance claims, continuity assessments, and risk mitigation planning.
  • Authority: Initiates cyber insurance claims and requests supporting documentation.
5.8 University Police Department (UPD)
  • Responsibilities: Primary law-enforcement liaison, maintains chain-of-custody, and coordinates with FBI.
  • Authority: May restrict or seize evidence and authorize transfer to federal agencies.
5.9 Federal Bureau of Investigation (FBI – Jonesboro Cyber Task Force)
  • Responsibilities: Advises on cybercrime cases, provides IOCs, and coordinates investigations.
  • Authority: May request evidence/logs but does not supersede university containment or recovery.

6. Incident Post-Review Checklist

Following incident closure, ITS will lead a post-review with participation from relevant groups based on severity. The checklist includes:

  • Policy Gaps
  • Policy/Procedure Compliance
  • Response Effectiveness
  • Communication Timeliness
  • Procedure Adequacy
  • Remediation Actions
  • Prevention of Recurrence
  • Follow-Up Plan
  • Risk Management Notification

7. Standards Review

This plan will be reviewed annually by the CIO, CISO, and ITS Security Panel or sooner if significant changes occur in technology, structure, or regulations.

Effective Date: September 17, 2025
Next Review Date: September 17, 2026
Version: 1.6

Appendix A – Security Panel Contact List

  • Chris Boothman – 870-253-8184
  • Jennifer Harrell – 870-253-9417
  • Patrick Jeffrey – 870-680-2110
  • Jacob Weaver
  • Chase Roberson – 870-514-9553
  • Himaja Balakrishnan – 870-897-6184
  • Chris Doyle – 870-578-7838
  • Heather Boothman – 870-930-8184
  • Jake Yandell
  • Shane Johnston
  • Ken Anderson – 870-761-7059
  • Eric Barnett
  • Shivani Payyavula – 870-627-8495

Law Enforcement Contacts:
University Police Department (UPD): 870-972-2093 (24/7 Dispatch)
FBI – Jonesboro Resident Agency (Cyber Task Force): 870-932-0700
Jonesboro Police Department (via UPD): 870-935-5551

Appendix B – IT Security Incident Report

Date of Report: ____   Prepared By: ____   Incident Date: ____

1. Executive Summary

Brief overview of the incident, severity, and outcome.

2. Incident Overview & Key Timestamps

Identify severity (IRP category), affected assets/data, and critical timestamps (detection, containment, recovery).

3. Initial Indicators

Describe type, initial vector, and IOCs/IOAs.

4. Containment & Mitigation Actions

Document containment steps, approvals, and responsible parties.

5. Evidence Log & Chain of Custody

Record all evidence, handlers, and UPD/FBI contacts with case numbers.

6. Notifications & Communications

List all internal/external notifications with times and methods.

7. Root Cause Analysis

Summarize underlying vulnerabilities, process gaps, or third-party issues.

8. Timeline of Events
Date Event Description
ENTER DATE ENTER TEXT
ENTER DATE ENTER TEXT
ENTER DATE ENTER TEXT
9. Lessons Learned

Document what worked, what didn’t, and improvement areas.

10. Recommendations

List technical and procedural remediation items.

11. Review & Approval

Sign-offs by CIO/CISO and Risk Management (if applicable).

Appendix C – Responsibility Matrix

Purpose: This matrix provides a concise execution view for incident responders and approvers.

Legend: R = Responsible  •  A = Accountable  •  C = Consulted  •  I = Informed

Activity / Phase (from IRP) CIO CISO Panel Legal Comms Exec Risk Vendor UPD FBI
Maintain IRP and contacts; resource enablement A R C C C C C C I I
Incident intake and initial notification/logging I A/R R I I I I I I I
Initial assessment and status (in progress? scope?) I A/R R C I I I I I I
Incident categorization (Cat 1–4) I A/R C C I I I I I I
Legal and compliance notifications decisioning I C C A/R I I C I I I
Law-enforcement trigger decision C A/R C C I I I I C C
External notifications (who/when) I C C A/R C I I I R R
Containment actions (isolate, disable, block) I A R I I I I C C C
Evidence preservation and chain of custody I A R C I I C C A/R C
Forensics and root cause (logs, imaging) I A R C I I I C C C
Eradication and recovery authorization A A/R C I I I I C I I
Eradication and recovery execution (rebuilds, resets, hardening, patches) I A R I I I I C I I
Validate clean state and return to service A R R I I I I C I I
Documentation (Incident Identification Form, evidence retention) I A R C I I C I C C
Impact and cost assessment C A/R C C I C C C I I
Communications and follow-up plan (audiences, cadence) C R C C A/R C I I I I
Lessons learned (≤ 30 days) and procedure updates I A/R R C C C I C C C
Annual plan review (or on significant change) A R C C C C I C I I
Back to top