| Policy Category | Policy Owner | Version Effective Date | Review Cycle | Last Reviewed | Policy Contact |
|---|---|---|---|---|---|
| X. Information Governance, Security & Technology | SVP, General Counsel, and Chief People Officer | March 27, 2023 | Every 4 years | January 28 2025 | Information Governance |
- Purpose
The purpose of this Policy is to ensure that the University is prepared to respond to Information Security Incidents, to protect University Information Systems and Information, and prevent disruption of University Information Resources by providing the required management for Incident handling, reporting, and monitoring. - Scope and Applicability
This Policy and its supporting standards and procedures apply to all Users who use or have access to UMGC Information Systems and Information Resources. - Definitions
Defined terms are capitalized throughout this Policy and can be found in the Information Governance Glossary. - Security Incident Response
- Under the direction of the Sr. Director, Information Security, a Computer Incident Response Team (CIRT) shall be established to ensure appropriate response to Security Incidents. The CIRT shall consist of Employees and Contractors with the technical, administrative, and communication skills required to facilitate a prompt and thorough mitigation and remediation response to Security Incidents.
- An Information Security Incident response plan shall be developed and implemented that:
- Provides a well-defined, organized approach for responding to critical Security Incidents affecting University Information Resources and Information Systems.
- Describes the structure, roles, and responsibilities of the incident response capability
- Identifies management and key personnel and ensures they are notified of Information Security Incidents as required
- Defines reportable Incidents
- Defines Severity Classifications for Information Security Incidents (High, Moderate, Low)
- Upon notification of a Security Incident, the Sr. Director, Information Security (or designee) will carry out an initial investigation and make the decision whether to activate the CIRT.
- The Information Security Incident response plan and procedures shall be reviewed at least annually to address system/organizational changes or problems encountered during implementation, execution, or testing.
- Handling of all Information Security Incidents shall be documented in the Information Security Incident response plan and all technology specific remediation processes shall be documented in a procedures document.
- All operational units and other related University Employees and Contractors are required to provide the CIRT with any assistance requested for purposes of investigation, remediation, and reporting of an Incident.
- Continuous monitoring must be deployed and be prepared to provide operational visibility and managed change control in support of Incident response duties.
- Incident Reporting
Any User who suspects or becomes aware of an Information Security Incident involving University information, Information Resources or Information Systems should contact the UMGC technical support service desk as soon as possible by calling 1-888-360-8682, emailing servicedesk@umgc.edu, or contacting UMGC Information Security. - Exceptions
Exceptions to this policy must be submitted to UMGC Information Security for review and approval. - Enforcement
- Any Faculty, Staff, Contractor, or third-party performing duties on behalf of the University with knowledge of an alleged violation of this Policy shall notify the Information Security as soon as practicable.
- Information System Stewards in consultation with the Office of Human Resources may instruct Access Account Managers, or other appropriate personnel to confiscate, temporarily suspend, or terminate Users' access to Information Resources while investigating an alleged violation of this Policy.
- Any Employee, Contractor, or other third-party performing duties on behalf of the University who violates this Policy may be denied access to Information Resources and may be subject to disciplinary action, up to and including termination of employment or contract.
- Standards Referenced
- Most recent versions
- USM IT Security Standards
- NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”
- Cybersecurity Maturity Model Certification (CMMC)
- Most recent versions
- Related Policies