IR-9 Information Spillage Response

Description

Identifies roles and responsibilities for responding to information spills.

Applicability

• This Control applies to the university Chief Information Security Officer and Information Resource Owner.

Implementation

• 1Information Resource Owners are responsible for responding to information spills by:

  • 1.1Identifying the specific information involved in the system contamination.
  • 1.2Alerting the CISO of the information spill according to reporting guidelines described in IR-6, and using a method of communication not associated with the spill.

• 2The Office of the CISO is responsible to respond to the report of information spillage by:

  • 2.1Isolating the contaminated system or system component.
  • 2.2Eradicating the information from the contaminated system or component.
  • 2.3Identifying other systems or system components that may have been subsequently contaminated.