DHS Adminstrative Policy: Privacy and Information Security Incident Response

DHS home | Policies | Administrative policies | Admin policies index | policy

	Administrative Services

Policy Title:	Privacy and Information Security Incident Response
Policy Number:	DHS-090-005	Version:	1.0	Effective Date:	10/01/2004

Approved By: DHS Chief Administrative Officer

Approved Date: 10/01/2004

Overview

Description: This policy requires DHS to establish an incident response team to address the handling of privacy and information security incidents. It requires DHS managers, workforce members and other authorized information users to report privacy and information security incidents. An incident is a threat or event that compromises, damages, or causes a loss of confidential or protected information. (e.g. unauthorized disclosure of information, failure to protect user ID’s, theft of computer equipment or client files, unexplained changes to a systems file, viruses, etc.) A more complete list of examples of privacy or information security incidents can be found at the DHS Information Security Office Incident Response web page

Purpose/Rationale: To provide quick, effective and orderly response to privacy and information security incidents ranging from unauthorized intrusions into DHS network systems to the mishandling of data in such a way that the privacy, integrity, or availability of confidential information is at risk.

Applicability: All individuals granted access to DHS information or systems are covered by this policy and shall comply with this and associated policies, procedures and guidelines. These individuals include full and part-time employees, volunteers, contractors, temporary workers, those employed by others to perform DHS work, and others authorized to access DHS information, network and/or systems.

Failure to Comply: Failure to comply with this policy and associated policies, standards, guidelines, and procedures may result in disciplinary actions up to and including dismissal from state service for employees, volunteers or termination of contracts for contractors, partners, consultants, and other entities. Legal actions may also be taken for violations of applicable regulations and laws.

Back to top

Policy

General

The DHS Information Security Office shall establish an incident response team to provide quick, effective, and orderly response to privacy and information security related incidents.
DHS managers, workforce members and other authorized information users are required to report privacy or information security incidents.
Users shall be informed of what constitutes a privacy or information security incident, reporting procedures, and how to avoid risks.

Incident Reporting

Incident reports must be submitted to the OIS Customer Service and Support Office (Help Desk) or directly to the Information Security Office.
Reports may be submitted verbally, electronically, printed or by fax as outlined in DHS-090-005-01, Information Security Incident Reporting Procedure.

Incident Response

The incident response team shall maintain incident response handling procedures regarding notification, assessment, investigation, remediation, monitoring, and reporting to the Information Security Officer.
The incident response team shall maintain procedures to report criminal related privacy and information security incidents to outside authorities complying with appropriate legal requirements and regulations.
The incident response team shall inform and coordinate incident response activities with the Cyber Security Incident Response Team.

Incident Documentation, Process Improvements and Mitigation

The Information Security Office shall document privacy and information security incidents and maintain incident activity logs.
The Information Security Office may facilitate privacy and information security related process improvement activities to reduce the risk of repeated incidents.
The Information Security Office shall inform DHS Executive Management of privacy and information security vulnerabilities that threaten the confidentiality, integrity or availability of DHS information, network or systems and provide strategies to mitigate the identified risks.