Cyber Incident Response Policy
How Jackson State University detects, reports, contains, and recovers from cyber security incidents — and who to contact when one occurs.
A quick, effective, and orderly response
JSU must ensure a quick, effective, and orderly response to cyber security incidents. This policy establishes the organizational structure for incident response, defines roles and responsibilities, and lists the requirements for reporting incidents.
Policy statement
The purpose of this policy is to ensure a quick, effective, and orderly response to security incidents. It defines what is considered a cyber-event and what is considered a cyber-incident, establishes the organizational structure for incident response, defines roles and responsibilities, and lists the requirements for reporting incidents.
- Policy Number
- 50000.022
- Effective Date
- 5/20/2020
- Review / Revised Date
- 3/09/2026
- Category
- Information Technology
- Policy Owner
- CIO / Information Technology
- Policy Contact
- CISO / Information Technology
Events and incidents
Cyber event
An event is an occurrence not yet assessed that may affect the performance of JSU's information system and/or network. Examples of events include an unplanned system reboot, a system crash, and packet flooding within a network.
Cyber incident
An incident is an assessed occurrence having potential or actual adverse effects on JSU's critical information systems. A cyber incident is an incident or series of incidents that violate the security policy.
- Event
- Not yet assessed
- Incident
- Assessed, with potential or actual adverse effects
- Categories
- Eight general categories of adverse events
- Response Team
- JSU Cyber Security Incident Response Team (CSIRT)
- Framework
- NIST and SANS Institute incident management best practices
Categories of security incident
Security incidents may include, but are not limited to, the following general categories of adverse events:
Employee adherence and general policy
This policy applies to all JSU employees, contractors, consultants, temporary and other workers, including all personnel affiliated with third parties who use JSU's information systems and services.
- Security events should be reported through appropriate management channels as quickly as possible.
- All personnel and contractors using JSU's information systems and services are required to note and report any observed or suspected security weakness or vulnerability in JSU systems or services.
- Management roles, responsibilities and procedures should be established to ensure a quick, effective, and orderly response to cyber events and incidents.
- JSU's Cyber Security Incident Response Team (CSIRT), led by its designated cybersecurity officer or appropriate cyber security personnel, detects and investigates security events to determine whether an incident has occurred, and the extent, cause and damage of incidents.
- JSU's CSIRT may coordinate its cyber incident response efforts with external parties when necessary and when existing agreements place responsibility for incident investigations on the external party.
- When conducting cyber security incident investigations, the JSU CSIRT is authorized to monitor relevant JSU IT resources and retrieve communications and other relevant records of specific users of JSU IT resources, including login session data and the content of individual communications, without notice or further approval and in compliance with the Monitoring of IT Resources Policy.
The incident management phases
In order to quickly and efficiently address a cyber incident, the JSU Cyber Security Incident Response Team will manage each incident using the following incident management phases, as outlined by NIST and SANS Institute incident management best practices.
Responsibilities as listed in the policy: compile a list or take inventory of all JSU assets, including but not limited to servers, networks, applications, and critical endpoints, and create a communication plan.
- To prepare for cyber incidents JSU's CISO, Cyber Security Officer or a qualified designated employee will ensure that members of the CSIRT are trained regarding their incident response roles and responsibilities in the event of data breach as mentioned in the JSU Incident Response Policy on an annual basis at minimum.
- Incident response drill scenarios and/or mock data breaches in tabletop exercises or other formats where appropriate will be used to evaluate the incident response plan and the employee's knowledge of addressing cyber incidents on an annual basis at minimum.
Responsibilities as listed in the policy: monitor traffic patterns for abnormalities; configure security tools, IDS and IPS to identify abnormalities and send alerts.
- JSU's CISO, Cyber Security Officer or a qualified employee on the JSU CSIRT will review available logs, emails, error messages and similar records to determine if an incident has occurred. If the CISO, Cyber Security Officer or other members of the JSU CSIRT team have determined or suspect that an incident has occurred, the first points of contact listed below will be JSU's CIO and CTO. The CIO and/or CTO will then notify and communicate details of the incident with the appropriate internal and external parties or stakeholders (for example JSU's President, media outlets, law enforcement).
- JSU's CISO, Cyber Security Officer and/or members of the JSU CSIRT shall not communicate information regarding data breaches, or any other cyber incident, with any internal or external parties (for example media platforms, third party vendors) that are not key persons for assisting with eradicating, identifying or investigating an incident.
- JSU's CISO, Cyber Security Officer and/or members of the JSU CSIRT shall capture and preserve evidence as soon as possible to be used for detection and investigation before proceeding with the containment process and eradication phase.
Responsibilities as listed in the policy: system administrators; Director and Management Team, Computing & Communications; network administrators; email administrator.
JSU's CISO, Cyber Security Officer and/or members of the JSU CSIRT shall take the appropriate actions as soon as possible. The JSU CSIRT may use some of the following actions as a starting point for containment remediation:
- Disable or remove compromised account access.
- Block malicious IP addresses or networks.
- Remove critical or compromised systems from the network.
- Contact providers for assistance (for example internet service providers, SaaS vendors).
- Whitelist network connections for critical servers and services.
- Kill or disable processes or services.
- Block or remove access for external vendors and partners, especially privileged access.
Responsibilities as listed in the policy: changing permissions on files so that they are writable by non-privileged users, deleting data files and or programs.
- JSU's CISO, Cyber Security Officer and/or members of the JSU CSIRT shall take appropriate necessary actions in a timely manner, depending on the severity and type of incident, to remove or eradicate threats to the University's assets and systems, ideally while minimizing data loss.
- Eradication efforts may be performed by the JSU CSIRT, CISO and Cyber Security Officer when possible, or authorized arrangements with a cleared third party vendor may be made for removing the threat and restoring affected systems to their previous state.
The JSU CSIRT may use some of the following actions as a starting point for its eradication efforts:
- Rebuild or restore compromised systems and data to a known-good state.
- Reset account passwords.
- Remove hostile accounts or credentials.
- Delete or remove specific malware (may use third party vendor).
- Activate and migrate to alternate locations, services, or servers.
Responsibilities as listed in the policy: computer viruses, worms, Trojan horses, logic bombs, spyware, adware, and backdoor programs.
JSU's CISO, Cyber Security Officer or a qualified designated employee of the CSIRT shall conduct testing, monitoring and validating of the infected systems, applications and similar assets while putting them back into production, in order to verify that they are not re-infected or compromised.
JSU's CISO, Cyber Security Officer or a qualified designated employee or members of the CSIRT will use lessons learned as documented in incident report forms to continue to update the necessary policies, to educate, and to improve future incident response efforts.
Points of contact for JSU cyber incidents
Dr. Deborah Dent
Dr. Michael Robinson
Mr. Dameion Brown
Policy compliance and related policies
Any JSU employee found to have violated this policy may be subject to disciplinary action, up to and including revocation of access privileges or termination of employment. In addition to University discipline, users may be subject to criminal prosecution under federal, state or local laws, civil liability, or both, for unlawful use of any IT system.
See something? Report it.
Security events should be reported through appropriate management channels as quickly as possible.
JSU Cyber Awareness
Student Center
Jackson, MS 39217-0280
