[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-253442-105":53,"doc-detail-253442-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","information-technology-security-incident-response-procedure-effective-date-october-18-2018","Information Technology Security Incident Response Procedure - Effective Date October 18, 2018","","Provides a university-wide procedure for responding to IT security incidents, including major incident reports, with the objective to limit and contain impacts, identify and reduce risk, and restore affected services quickly. Defines incident reporting and detection expectations for suspected security events, breaches, and threats, then details identification, analysis, risk-based classification, and prioritization. Establishes containment actions, incident response team formation, role assignment, communications planning, third-party escalation criteria, and guidance for investigator coordination to support a consistent incident lifecycle.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":41,"@type":70,"position":76},"https://docshare.wps.com/template/letters/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/information-technology-security-incident-response-procedure-effective-date-october-18-2018/253442/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/information-technology-security-incident-response-procedure-effective-date-october-18-2018/253442.png","ImageObject",442,249,{"name":88,"@type":89},"Berry Peter","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-09-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",7,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What is the purpose of the IT security incident response procedure?","Question",{"text":109,"@type":110},"To limit and contain the impacts of an IT security incident, reduce risk, and restore affected services quickly while providing a consistent incident lifecycle process.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"How are incidents identified and analyzed after a report or detection?",{"text":114,"@type":110},"Details of the security event are analyzed to confirm whether it constitutes an information security incident, including validation of whether it is ongoing and evaluation of potential impact.",{"name":116,"@type":107,"acceptedAnswer":117},"How is containment handled and who leads the response team?",{"text":118,"@type":110},"An incident response team is built based on initial classification, an Incident Leader is assigned, and containment actions are implemented to limit damage; severity may trigger involvement of the CISO/CIO and other relevant roles.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},253442,1790173469,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":40,"category_name":41,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":79},1374402524268,"https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","INFORMATION TECHNOLOGY INCIDENT MANAGEMENT  \nEffective Date: October 18, 2018  \nLast Revised: January 23, 2026  \nINFORMATION TECHNOLOGY SECURITY INCIDENT RESPONSE PROCEDURE  \nOVERVIEW  \nThis document provides the University’s guide for responding to the receipt of an IT Security Incident or Major IT Security Incident report. The goal of this procedure is to limit and contain the impacts , identify and reduce risk, and restore services quickly to systems impacted by a security incident. It outlines the steps University Community Members can follow for reporting IT threats or security concerns , the essential steps for how the Information Technology Services division will identify or classify an incident, roles and responsibilities for incident response teams, and the workflow that incident response teams should follow during the incident lifecycle.  \nAccording to the National Institute of Standards and Technology (“NIST”) Computer Incident Handling Guide, an incident is defined as “a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.” Some examples include, but are not limited to, the following:  \n▪ Exposure or compromise of sensitive information (compromised integrity)  \n▪ Loss or breach of information confidentiality and/or availability  \n▪ Health and Safety Investigations  \n▪ Forensics and other types of subpoena requests  \n▪ Violation of campus security policy  \n▪ Violation of computer or network acceptable use policy  \n▪ Misuse of services, systems, or information  \n▪ Physical damage to systems  \n▪ Theft/loss of computers  \n▪ Denial of service or large-scale attacks and intrusions to systems or groups of systems  \n▪ Malicious attacks such as rootkit, malware, ransomware, exploitation of systems , virus outbreaks  \n▪ Unauthorized computer access and/or stolen credentials  \n▪ Unexpected or unapproved modifications to programs  \nSCOPE  \nThis guide applies to all NAU-owned systems and any devices that store or transmit NAU data.  \nThis document provides guidance during an information security incident, regardless of the size and represents typical steps taken by the Information Technology Services (“ITS”) division. The identification and classification steps in the workflow are where decisions are made. Decisions will be based on the level of risk assessed. If an information security incident response team is deemed necessary, the roles, responsibilities, and steps defined in this document will be followed as they detail an approved and consistent process.  \nThe steps identified in this document may be determined inappropriate in certain circumstances. The Chief Information Officer (“CIO”) and/or the Chief Information Security Officer (“CISO”)/Director of Information Security Services (“ISS”) may decide to follow different steps in these cases. All such decisions will be documented and reviewed during lessons learned and response wrap-up.  \nWORKFLOW  \nThe diagram below provides the high-level security incident response cycle. Stages of the cycle are detailed ina section following the diagram.  \nA. Reporting and Detection.  \n▪ Suspected Security Events, Incidents, and Breaches must be reported immediately to ISS Security events may be detected by ISS and handled internally  \nB. Identification and Analysis. The reported or detected Security Event is analyzed and details confirmed to determine if it is an information Security Incident.  \n▪ Analyze the details of report in order to validate that an information Security Incident has occurred  \n▪ If it is determined that an information Security Incident has NOT occurred, a standard ServiceNow ticket should be created  \n▪ Identify the affected systems, devices, data type(s) involved  \n▪ Determine if the information Security Incident, from here on referenced as Incident, is still/currently in progress or not  \n▪ Evaluate the potential effect of the Incident  \n▪ Classify and prioritize the incident, such as ","cbCaioUHg8hKHWBb","https://ap.wps.com/l/cbCaioUHg8hKHWBb","pdf",354277,10,"English","# Overview\n## Incident definition and examples\n# Scope\n# Workflow\n## Reporting and Detection\n## Identification and Analysis\n## Containment","[{\"question\":\"What is the purpose of the IT security incident response procedure?\",\"answer\":\"To limit and contain the impacts of an IT security incident, reduce risk, and restore affected services quickly while providing a consistent incident lifecycle process.\"},{\"question\":\"How are incidents identified and analyzed after a report or detection?\",\"answer\":\"Details of the security event are analyzed to confirm whether it constitutes an information security incident, including validation of whether it is ongoing and evaluation of potential impact.\"},{\"question\":\"How is containment handled and who leads the response team?\",\"answer\":\"An incident response team is built based on initial classification, an Incident Leader is assigned, and containment actions are implemented to limit damage; severity may trigger involvement of the CISO/CIO and other relevant roles.\"}]","Information Technology Security Incident Response Procedure - Effective Date October 18, 2018 | PDF",1789266036]