Source: https://chancellor.maricopa.edu/public-stewardship/governance/administrative-regulations/4-auxiliary-services/4.24-information-security-and-privacy-incident
Timestamp: 2017-06-25 07:07:08
Document Index: 716236329

Matched Legal Cases: ['§ 44', '§ 28', '§ 28', '§ 1232', '§ 99', '§ 160', '§1232']

You are hereChancellor's Office Home » Public Stewardship » Governance » Administrative Regulations » 4 Auxiliary Services » 4.24 Information Security and Privacy Incident Response Plan
Overview Description: To advance MCCCD’s operational responsibilities and to comply with federal, state, local and international laws relevant to information privacy and security, this administrative regulation outlines the responsibilities and procedures of Maricopa County Community College District’s (“MCCCD”) collective body, known as the Information Security and Privacy Incident Response Team (“IRT”). The IRT is defined in Appendix AS-14 and is charged with responding to actual or suspected situations involving unauthorized access to and/or misappropriation of Confidential Information.[1][2]
The Incident Response Team (“IRT”) is chaired by the Chief Information Security Officer, the Chief Privacy Officer, and the Director of Enterprise Risk Management (“Risk Manager”) (collectively, “Core IRT”), who are assigned primary responsibility for providing a thorough and orderly response to an actual or suspected Security Incident. While Information security and privacy is everyone’s responsibility, the IRT’s specific mission is to provide an effective and skillful response to actual or suspected Security Incidents by taking appropriate steps to investigate, contain, and mitigate each incident while reporting findings to management in a timely, efficient manner. The IRT aims to protect Confidential Information and minimize financial loss by ensuring evidence gathering, chain of custody tracking, and preservation of data, as appropriate. The IRT provides a coordinated response to actual or suspected Security Incidents. The IRT includes, as needed, representatives from operating units within MCCCD along with their alternates. Each represented operating unit has designated one IRT member. The Core IRT is in charge of leading the incident response. Where a Core IRT is absent during a Security Incident, the Core IRT alternate has the same level of responsibility and expectations under this administrative regulation as does the member of the Core IRT for which he or she serves as an alternate. If, as a result of an actual or suspected Security Incident, the Chief Information Security Officer and the Chief Information Officer/Vice Chancellor for Information Technology determine that it is necessary to take immediate action involving MCCCD’s information technology systems, the Chief Information Security Officer and the Chief Information Officer will determine the appropriate action to take and take that action, consulting with legal counsel if needed, and informing the Chancellor promptly of the determination made and the need for the actions to be taken or already taken. Any subsequent changes to the action taken require the approval of the Chief Information Security Officer and the Chief Information Officer. Appendix AS-14 (“Appendix”) contains the job titles that constitute the members of the IRT. The CORE IRT will determine, based on the type of Security Incident involved, which members of the IRT will be called to provide assistance. On a quarterly basis, the IRT will review and, if needed, recommend an update to the job titles listed in the Appendix to ensure that they include the appropriate personnel with District-wide oversight over Confidential Information, employment matters, student matters, and MCCCD’s security and privacy. The Core IRT will report the results of its review to the Chancellor for review, revision and approval. The Core IRT will also promptly update the Appendix when the names of the persons in those job titles changes.
With the agreement of the Core IRT, other MCCCD employees or critical contractors may be asked to assist with, for instance, the investigation of an actual or alleged Security Incident (“Auxiliary Personnel”). The IRT will limit the scope of work performed by Auxiliary Personnel at the request of the IRT, along with the time period that the Auxiliary Personnel is involved, to that necessary to investigate facts or to implement mitigation/remediation procedures. Additionally, the Core IRT along with other IRT members will use their best efforts to avoid methods of communication among themselves that may increase the potential for sensitive or confidential information being shared inappropriately outside of the IRT. The IRT includes representatives of several operating units within MCCCD. The IRT provides a coordinated response to actual or suspected Security Incidents. Each represented operating unit has designated one IRT member. The Chief Information Security Officer and Chief Privacy Officer are in charge of the incident response, along with alternates who are designated by the Chief Information Security Officer and Chief Privacy Officer, respectively, to assume authority in all capacities including IRT responsibilities, if the Chief Information Security Officer and Chief Privacy Officer are absent or otherwise unavailable. Listed below are the roles and responsibilities of each operational unit represented on the IRT:
For the Chief Privacy Officer in conjunction with the General Counsel, provide legal advice in connection with any actual or suspected Security Incident. Incident Response Steps
7. Conduct an Annual Review and Simulation Amended by Direct Chancellor Approval: August 24, 2016
Appendix AS-14
Standing Information Security and Privacy Incident Response Team Members
The Maricopa County Community College District is committed to ensuring the protection of private information. This language serves as a supplement to MCCCD administrative regulations 4.22 through 4.24, which are known as the Privacy Statement, the Written Information Security Program and the Information Security and Privacy Incident Response Plan, respectively. Individuals in the following roles shall serve to facilitate the implementation of the respective regulations. Likewise, the Chancellor may name or appoint additional designees as appropriate:
Associate Vice Chancellor for Information Technology Infrastructure
Associate Vice Chancellor of Information Technology Enterprise Resource Planning
Vice President for Strategy and Compliance
Chief Information Security Officer and Associate Vice Chancellor for Information Technology
District Director of Business Applications and Compliance
Associate Vice Chancellor of Business Services and Comptroller
District Director of Human Resources Solutions Center
Assistant General Counsel for Employment
Definitions: As used in this administrative regulation, the following terms have the respective meanings set forth below: ARS: Arizona Revised Statutes; the statutory laws that govern the state of Arizona as formally enacted in writing by the Arizona State Legislature, such as the Arizona law that requires businesses, including, but not limited to, colleges and universities, to provide consumer notification of data breaches involving personally identifiable information. Pursuant to ARS § 44-7501, “personally identifiable information (PII) (a) Means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the data element is not encrypted, redacted or secured by any other method rendering the element unreadable or unusable: (1) The individual's social security number; (2) The individual's number on a driver license issued pursuant to ARS § 28-3166 or number on a non-operating identification license issued pursuant to ARS § 28-3165; or (3) The individual's financial account number or credit or debit card number in combination with any required security code, access code or password that would permit access to the individual's financial account.” PII does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.
FERPA: Family Educational Rights and Privacy Act; a federal law that protects the privacy of student education records. "Education records" are "those records, files documents, and other materials which 1) contain information directly related to a student; and 2) are maintained by an educational institution.” (20 U.S.C. § 1232g(a)(4)(A); 34 CFR § 99.3). FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education. GLBA aka Financial Services Modernization Act of 1999: Gramm–Leach–Bliley Act; an Act that requires “financial institutions,” including, but not limited to, colleges and universities, to protect the privacy of their customers, including information that customers provide to a financial institution that would not be available publicly (“personally identifiable financial information (PIFI)”).[7] MCCCD, therefore, has a responsibility to secure the personal records of its students and employees. To ensure this protection, GLBA mandates that all financial institutions establish appropriate administrative, technical and physical safeguards. GLBA also requires financial institutions to provide notice to customers about their privacy policies and practices, but institutions of higher education are generally exempt from this requirement, because they already do so under FERPA. Colleges and universities complying with FERPA are considered to be in compliance with GLBA.
HIPAA Privacy Rule aka Privacy Rule: A federal regulation that (1) establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically, (2) requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization, and (3) gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections. The Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information “protected health information (PHI).” (45 CFR § 160.103). Individually identifiable health information” is information, including demographic data, that relates to:
and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Ibid. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, social security number). The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g. Information Security and Privacy Incident Response Team (IRT): The internal ad hoc team of MCCCD employees that is convened to provide incident handling services to MCCCD during an actual or suspected Security Incident and to respond to that incident when the need arises. Payment Card Industry Data Security Standard (PCI DSS): Payment Card Industry Data Security Standard; a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, automated teller machine (ATM), and point-of-sale (POS/ePOS) cards. “Payment card information” is any personally identifiable information associated with a cardholder, such as the cardholder’s account number, account expiration date, name, address, or social security number. All personally identifiable information associated with the cardholder that is stored, processed, or transmitted is also considered payment card information. Personnel: All full-time, part-time and temporary employees and faculty who work for the MCCCD organization. POI: Person(s) of Interest; individuals such as the following who are not considered part of the MCCCD workforce but who are still of interest to the organization:
Consultant Individuals who are hired to do specialized work for MCCCD and are paid by outside sources
Security Incident: The unauthorized access to and/or misappropriation of Confidential Information, or threats to the security and privacy of MCCCD’s information technology systems, such as malware or ransomware. The term “Security Incident” includes instances in which security or privacy, or both, are involved.
MCCCD Appendix AS-14 Standing Information Security Incident Response Team Members as attached to this administrative regulation known as MCCCD Administrative Regulation 4.23 Information Security Incident Response Plan
Pursuant to MCCCD Administrative Regulation 6.11 Identity Theft Red Flag and Security Incident Reporting: (1) anyone, including, but not limited to, any MCCCD Personnel and POI, who notices and/or suspects that MCCCD Confidential Information may currently be or may have been exposed to someone without authorization should immediately contact the Chief Privacy Officer at 480-784-0PII (x 4-0PII or x 4-0744) or [email protected], and (2) the Chief Privacy Officer is designated as the exclusive recipient of reports of this nature. The Chief Privacy Officer is responsible for obtaining details about the situation from the individual(s) and coordinating with the IRT to take any additional actions that the IRT deems necessary.
The IRT is responsible for completing the analysis necessary to determine whether a breach has indeed happened. Deciding whether a breach of Confidential Information has happened is a complex technical and legal determination that involves detailed analysis. Neither MCCCD Personnel, POIs, nor students should postpone notification of the Chief Privacy Officer until they have further investigated or made a breach determination. It is very important that the Chief Privacy Officer be made aware of the situation immediately so that the proper steps can be taken to protect Confidential Information. MCCCD encourages anyone to report their hunch or suspicion right away, since MCCCD counts on everyone to share the responsibility for keeping information secure.
Please email [email protected] with any questions and concerns about the MCCCD administrative regulations. Please email [email protected] with any legal questions and/or to arrange for the evaluation of any vendors, subcontractors and/or third-party products in advance of any work or purchase. Amended by Direct Chancellor Approval: August 24, 2016
[3] See, for example, MCCCD Administrative Regulations 2.1 General Regulation, 2.5.1 Disciplinary Standards, and 2.5.2 Student Conduct Code. [4] The IRT is convened in its entirety or in part, depending on the specific situation that arises and the skills and competencies required for MCCCD to appropriately respond to the situation. A list of the current IRT membership is attached to this administrative regulation as provided at Appendix AS-14 Standing Information Security Incident Response Team Members.
Print Section (Adobe Acrobat - Requires Adobe Acrobat Reader) ‹ 4.23 Written Information Security Program
5 Non-Discrimination ›