Incident Response Overview for Cyber and Disasters
Document Purpose
This plan strives to clarify responsibilities and actions required to respond, report and review major events at Boise State University.
Roles and Responsibilities
The Incident Response Team will consist of :
- IRP Response Director – has overall management responsibility for the IRP. This can be either the DCIO or the CISO. The first to respond will be the director, unless otherwise agreed upon to switch roles or as appointed by the CIO. The other acts as backup and is ready to rotate if the incident takes multiple days.
- IRP Coordinator – is responsible to oversee assessment, recovery and reconstitution progress, initiate any needed escalations or awareness communications, and establish coordination with other assessment, recovery and reconstitution teams as appropriate.
- IRP Team – Technical staff responsible for deploying recovery and reconstitution efforts as outlined by the IRP Coordinator.
- IRP Communications Lead – Receives direction from RD to provide and direct communications content to Campus Operations Emergency Management and the Office of Communications and Marketing.
- Mission Critical System Owner – is responsible for assisting in mission critical system recovery and reconstitution efforts as requested by the IRP Coordinator.
- Customer Care Staff – is responsible for managing the response and triangle of customer inquiries and client side incidents.
- Legal Contact – General Council or designate with the responsibilities to provides advice as appropriate
At a minimum will consist of a Response Officer, Response Coordinator and at least one Technical Staff. Customer Care, OIT Communications and General Council staff members will be optional as determined by the Director. Team positions may be supplemented by other OIT staff as warranted by the Director.
Incident Handling
Below are five elements for successful incident handling and the individuals responsible for taking the action. Multiple individuals or teams will be involved in performing the following:
- Identify
- Assess the incident
- Respond to the incident
- Notify and Report
- Learn and Improve
Incident Response Team
| Team Role | Personnel |
|---|---|
| Response Director | Deputy CIO Chief Information Security Officer |
| Response Coordinator | Executive Director, Cloud Services and Infrastructure Senior Security Engineer (Deputy CISO) |
| Team | OIT Staff as required |
| Optional Team Members: | Manager of Help Desk or designee Director of OIT Communications or designee General Counsel or designee |
Updates
Created: January 2016
Last Update: February 2022
Next Review: February 2025