Ohio Administrative Code › Title 3364 - University of Toledo › Chapter 3364-65 - Technology Security and Safeguarding › Section 3364-65-10 - Technology incident response policy

Current through all regulations passed and filed through July 1, 2024
(A) Policy statement
Technology is an integral part of how the university carries
				out its mission. The university must be prepared to evaluate unwanted technical
				events effectively and to respond appropriately when security incidents are
				identified. Preparation and planning for an incident and ensuring that the
				right resources are available is vital to the university's ability to further
				prevent, detect, respond and recover from information technology security
				incidents.
(B) Purpose
This policy defines adverse technology events and incidents and
				identifies their respective security response requirements.
(C) Scope
This policy applies to all university organizational
				units.
(D) Definitions
(1) Adverse event. Any observable occurrence
			 with a negative consequence or impact to the confidentiality, integrity, or
			 availability of a technology asset, system, or network. Examples of adverse
			 events include system crashes, network packet floods, unauthorized use of
			 system privileges, unexplained alteration of data, missing or unaccounted-for
			 computing equipment, or other unexplained harmful or unwanted
			 activity.
(2) Incident. A suspected
			 or identified adverse event or group of adverse events, which if confirmed has
			 or had significant potential to negatively impact the confidentiality,
			 integrity, or availability of sensitive data or university technology assets.
			 An incident may also be an identified violation or imminent threat of violation
			 of a university policy. Some examples of possible information technology
			 security incidents include:
(a) Loss of
			 confidentiality of information;
(b)
			 Compromise of integrity of information;
(c) Loss of system availability or denial of
			 service;
(d) Loss or theft of a
			 technology asset;
(e) Unauthorized
			 damage to, or destruction of, a technology asset;
(f) Unauthorized execution of, or damage to
			 systems by, malicious code, such as viruses, trojan horses or hacking
			 tools;
(g) Compromise of
			 authentication data or username and password credentials;
(h) Use of university technology assets in
			 violation of state or federal law.
(3) Incidents are categorized into two
			 classes:
(a) Major incidents. Major incidents
			 are those incidents that pose a material threat to the security of sensitive
			 data, based on a risk analysis or other predetermined criteria.
(b) Minor incidents. Minor incidents are
			 those incidents that do not rise to the severity of a major incident, based on
			 a risk analysis or predetermined criteria.
(4) Incident response. A structured and
			 organized response to any information technology security adverse event or
			 incident that threatens an organization's system assets, including systems,
			 networks and telecommunications systems.
(5) Incident response team. A group of
			 professionals within an organization empowered to respond to identified
			 information technology security incidents.
(6) Sensitive data. Sensitive data is data
			 for which the university has an obligation to maintain confidentiality,
			 integrity, or availability.