PROCEDURE TITLE: SECURITY INCIDENT RESPONSE
APPLIES TO:
All KSU students, faculty, staff, Board of Regent members, and all others who use, have access to, store, transmit or oversee KSU information technology resources. This applies to access of any KSU information resource from any device.
ADMINISTRATIVE AUTHORITY:
APPROVED BY: Kentucky State University Board of Regents
EFFECTIVE DATE: August 8, 2025
NEXT REVIEW DATE: August 8, 2028
The purpose of this policy is to establish the appropriate response to identify, investigate, contain, eradicate, and remedy a security incident. The policy will also provide procedures to document, report and communicate the incident. Responsibility for each step will be established in this policy.
Confidential Data: This classification applies to the most sensitive data or information that is intended for use strictly within KSU, protected by any confidentiality agreements, or data protected by federal or state law, such as FERPA, HIPPA, GLBA or PCI-DSS. Its unauthorized disclosure could seriously and adversely impact KSU, its customers, its business partners, and its suppliers.
Restricted Data: This classification applies to less-sensitive business data or information that is intended for use within KSU. By default, all information that is not defined as confidential or public should be treated as restricted. Its unauthorized disclosure could adversely impact KSU, or its customers, suppliers, business partners, or employees, but would not violate law.