Plan for a Loss or Breach
________________________________________
Document Number: REDFLAG--110
Revision #: 2.0
Document Owner:VP of Business and Finance
Date Last Updated: 04/25/2018
Primary Author: VP of Business and Finance
Status: Approved
Date Originally Created: 12/15/2011
________________________________________
General Description
Description:
Information about the plan for a loss or breach relative to Red Flags Identity Theft Policy.
Purpose:
Delineation of policy and procedure.
Scope:
All faculty, staff, students, and administrators
Responsibility:
Administration
VP of Business and Finance
________________________________________
Requirements
Relevant Knowledge:
Current University policy
Federal statutes
Local statutes
Standard company policies
Standards of good practice
State statutes
Terms and Definitions:
Additional training
Corrective Action
Loss of privilege, general
________________________________________
Policy Provisions
1. Plan for a Loss or Breach
1.1 Information Security Audits
The Identity Theft Prevention Officer is authorized to conduct security audits of any area containing CSI at anytime to ensure the safety and security of that information.
1.2 Discovery of a Breach in the Workplace
1. Employee Protocol
• Do not disturb the area.
•Secure the area.
•Notify manager or supervisor.
•Manager will contact Identity Theft Prevention Officer
•Document the event.
•Submit to Identity Theft Prevention Officer.
2. Manager or Supervisor Protocol
•Ensure affected area is secure. Do not let anyone use the phone or computer in that area.
•Gather visitor logs, employee time sheets, list everyone who had access before, during, and after the incident.
•Interview employee witness(es).
•Contact ISO.
•Identity Theft Prevention Officer Protocol
•Determine that there is a breach
•Interview Employee Witness
•Review Security Incident Report
•Contact the University attorney
•Make a police report
•Notify potential victims according to legal statutes.
•Public relations and continuity considerations.
1.3 Discovery of a Breach Through Accusation
1. Employee Protocol
•Be sympathetic to the potential victim
•Do not confirm or deny their allegations
•Document the conversation
•Document contact information
•Inform them that your Identity Theft Prevention Officer will contact them.
2. Identity Theft Prevention Officer Protocol
•Interview Employee Witness
•Review Security Incident Report
•Contact potential victim.
•Ask them to reiterate their story.
•Assure them that you will look into it.
•Contact your attorney.
•Determine that there is a breach
•Assess the extent of damage
•Make a police report
•Notify potential victims according to legal statutes.
•Public relations and continuity considerations
________________________________________
Performance Evaluation
Performance Metrics:
Compliance with standard policy and procedure
Compliance with federal mandate
Consequences:
Further training
Loss of privileges
________________________________________
Subject Experts
The following may be consulted for additional information.
VP of Business and Finance