Overview

It is the policy of the University of Michigan to handle information security incidents so as to minimize their impact on the confidentiality, integrity, and availability of the university’s systems, applications, and data. An effective approach to managing such incidents also limits the negative consequences to both the university and individuals, and improves the university’s ability to promptly restore operations affected by such incidents.

It is especially important that serious information security incidents that may result in disruptions to important business processes are promptly communicated to the appropriate university officials so that they are involved early in decision-making and communications. In addition, compliance with various federal and state regulations requires expeditious reporting of certain types of incidents.

While information security incidents are not always preventable, appropriate procedures for incident detection, reporting and handling, combined with education and awareness of the U-M community, can minimize their frequency, severity, and potentially negative individual, operational, legal, reputational, and financial consequences

The goals of establishing a successful incident management capability include:

1. Mitigating the impact of IT security incidents.
2. Identifying the sources and underlying causes of IT security incidents and unauthorized disclosures to aid in reducing their future likelihood of occurrence
3. Protecting, preserving, and making usable all information regarding the incident or disclosure as necessary for forensic analysis and notification.
4. Ensuring that all parties are aware of their responsibilities regarding IT system security incident handling.
5. Protecting the reputation of the university.

Definitions

1. An information security incident is a suspected, attempted, successful, or imminent threat of unauthorized access, use, disclosure, breach, modification, or destruction of information; interference with information technology operations; or significant violation of responsible use policy, (as defined in Responsible Use of Information Resources (SPG 601.07). Examples of information security incidents
   1. Computer system intrusion
   2. Unauthorized or inappropriate disclosure of sensitive institutional data
   3. Suspected or actual breaches, compromises, or other unauthorized access to U-M systems, data, applications, or accounts
   4. Unauthorized changes to computers or software
   5. Loss or theft of computer equipment or other data storage devices and media (e.g., laptop, USB drive, personally owned device used for university work) used to store private or potentially sensitive information
   6. Denial of service attack or an attack that prevents or impairs the authorized use of networks, systems, or applications
   7. Interference with the intended use or inappropriate or improper usage of information technology resources.

   While the above definition includes numerous types of incidents, the requirement for central security incident reporting, regardless of malicious or accidental origin, is limited to serious incidents as defined below.

   Occurrences such as incidental access by employees or other trusted persons where no harm is likely to result will usually not be considered information security incidents.

2. A serious incident is an incident that may pose a substantial threat to university resources, stakeholders, and/or services. An incident is designated as serious if it meets one or more of the following criteria:
   1. Involves potential, accidental, or other unauthorized access or disclosure of sensitive institutional information (as defined below)
   2. Involves legal issues including criminal activity, or may result in litigation or regulatory investigation
   3. May cause severe disruption to mission critical services
   4. Involves active threats
   5. Is widespread
   6. Is likely to be of public interest
   7. Is likely to cause reputational harm to the university
3. Sensitive information is defined in Institutional Data Resource Management Policy, (SPG 601.12) as information whose unauthorized disclosure may have serious adverse effect on the university’s reputation, resources, services, or individuals. Information protected under federal or state regulations or due to proprietary, ethical, or privacy considerations will typically be classified as sensitive. Sensitive information includes personally identifiable information such as protected health information (PHI), Social Security numbers, credit card numbers, and any other information designated as sensitive by university data stewards.

Scope

This policy is platform and technology neutral, and applies to the entire university, including the Ann Arbor campus, Michigan Medicine, U-M Dearborn, U-M Flint, Athletics, and all affiliates.  Specifically, the scope of this policy encompasses:

1. Faculty, staff, and all units
2. Third-party vendors who collect, process, share or maintain university institutional data, whether managed or hosted internally or externally;
3. Personally owned devices of members of the U-M community that access or maintain sensitive institutional data.

Policy

1. All users of university IT resources must report all information security incidents to their IT security provider or security unit liaison.
2. Any event that appears to satisfy the definition of a serious information security incident must be reported to Information Assurance (IA).
3. It is expected that incident reporting, from identification to reporting to IA (if necessary), will occur within 24 hours.
4. Some information security incidents may also be criminal in nature (e.g., threats to personal safety or physical property) and should immediately be reported to the U-M Division of Public Safety and Security concurrent with the incident notification described in section VII of this policy.
5. To avoid inadvertent violations of state or federal law, individuals and departments may not release information, electronic devices, or electronic media to any outside entity, including law enforcement organizations, before making the notifications required by this policy.
6. 1. Information related to campus security information security incidents is classified as sensitive under SPG 601.12.
   2. When university staff report, track, and respond to information security incidents, they must protect and keep confidential any sensitive information.
   3. Incident data retained for investigation will exclude any sensitive information that is not required for incident response, analysis, or by law, regulation, or university policy.

Roles and Responsibilities

1. The University Chief Information Security Officer is the ultimate authority for interpretation and implementation of this policy, as well as for coordinating serious information security incident communications.  The Office of the University Chief Information Security Officer will retain relevant records and evidence pertaining to all serious incidents for a period of three years after the occurrence of the event.  For incidents involving unauthorized disclosure of PHI, records will be retained for six years.
2. Information Assurance (IA) will oversee, coordinate, and guide the incident management process to promote a consistent, efficient, and effective response, including compliance with applicable breach notification laws and regulations. IA staff serve as the information security provider for Information and Technology Services and all MiWorkspace units.

   In addition, IA shall:

   1. Convene, when appropriate, a multi-department Computer Security Incident Response Team (CSIRT).
   2. Collaborate and coordinate with other university offices including applicable compliance offices.
   3. Take appropriate steps to preserve forensic evidence.
   4. Lessons learned meetings will be conducted for all serious information security incidents to review the effectiveness of the incident handling process, prevent recurrence of similar incidents, and identify potential improvements to existing security controls and practices.
   5. Conduct ongoing information security incident reporting education and awareness for the U-M community.
3. Users of University Information Technology Resources: All faculty, staff, and workforce members must report serious information security incidents to the ITS Service Center for MiWorkspace units and the ITS Service Center and their unit’s security unit liaison for non-MiWorkspace units within 24 hours of becoming aware of the incident.
4. Security Unit Liaisons: The Security Unit Liaison is a staff member that has been designated by the unit dean or director to provide unit oversight of information security, communicate and coordinate related activities with Information Assurance (IA), evaluate and respond to non-serious incidents, and coordinate unit response to risk assessments and audit requests. Liaisons also develop and implement unit-level policies, procedures, communications, and educational awareness programs consistent with university-wide guidance.
   1. Security unit liaisons or their designees must report suspected serious incidents (reported to or identified by them) within the 24 hour timeframe.  When an incident involves the types of sensitive information below, the liaisons must also report the incident to the following parties:
      1. If an incident involves protected health information (PHI), security unit liaisons must report the incident to Information Assurance (IA) at [email protected] and the University HIPAA Officer at [email protected].
      2. If an incident involves any human subject research information, security unit liaisons must report the incident to IA at [email protected] and the Office of Research (UMOR) [email protected]. UMOR will report the incidents to the appropriate Institutional Review Board and the IRBs will alert research teams, as needed.
      3. If an incident involves both protected health and human subject research information, UMOR ([email protected]), the University HIPAA Officer ([email protected]), and IA ([email protected]) should receive the report at the same time and work together on any required follow-up. UMOR will report the incidents to the appropriate IRB, and the IRBs will alert research teams, as needed.
      4. If an incident involves payment card information (PCI), a U-M merchant must report the incident to the Treasurer’s Office at [email protected] and IA at [email protected].
   2. Security unit liaisons and associated unit IT staff will appropriately support IA staff in incident handling and post-incident investigations and will evaluate and respond to information security incidents in accordance with university and unit policies and procedures.
   3. Security unit liaisons for non-MiWorkspace units will, as necessary, develop and implement unit-level policies, procedures, communications, and educational programs that are consistent with this university-wide incident reporting policy.
5. The University HIPAA Officer, UMOR, and the Treasurer’s Office will inform IA of serious incidents reported to them.
6. Third Party Vendors and Contractors:  U-M has an ownership, stewardship, or custodial interest in all university data, regardless of how or where it is stored, transmitted, or processed. The reporting requirements of this policy apply to third parties that are contractually bound to limit the access, use, or disclosure of U-M information assets. These third party vendors or entities shall report potential or actual incidents to the university per the terms of their contract and/or the university’s data protection addendum.

Violations and Sanctions

Violations of this policy may result in disciplinary action up to and including suspension or revocation of computer accounts and access to networks, non-reappointment, discharge, dismissal, and/or legal action. Discipline (SPG 201.12) provides for staff member disciplinary procedures and sanctions.  Violations of this policy by faculty may result in appropriate sanction or disciplinary action consistent with applicable university procedures. If dismissal or demotion of qualified faculty is proposed, the matter will be addressed in accordance with the procedures set forth in Regents Bylaw 5.09. In addition to U-M disciplinary actions, individuals may be personally subject to criminal or civil prosecution and sanctions if they engage in unlawful behavior related to applicable federal and state laws.

Reporting Incidents

1. Information Assurance (IA) — [email protected]
2. Incidents involving PHI: University HIPAA Officer — [email protected]
3. Incidents involving human subject research: Office of Research — [email protected] and Institutional Review Boards — [email protected]; or [email protected]
4. Incidents involving payment card information (PCI): Treasurer’s Office — [email protected]
5. Incidents that may also be crimes or threats to personal safety: Division of Public Safety and Security — (734) 763-8391

Related Policies

1. Responsible Use of Information Resources (SPG 601.07)
2. Institutional Data Resource Management (SPG 601.12)
3. Information Security (SPG 601.27)
4. Report an IT Security Incident, Safe Computing