2022-077-E-IT Dept-PUBLIC LIBRARY ASSOCIATION, a divison of the American Library Association-Digital learning

Browse Search

DocuSign Envelope ID:24BBAFA9-CD81-4144-ACEF-E9036E703739 The plan will address specific incident response procedures, business recovery and continuity procedures, data backup processes, roles and responsibilities, and communication and contact strategies (e.g., informing HHS and State/Local authorities). The intent of the Incident Response Plan is to mitigate risk, and the company will respond to incidents according to the following priorities: • Human life and safety. • Sensitive or mission-critical systems and data. • Other systems and data. • Damage to systems and data. • Disruption to access or services. Specifically, this Incident Response Plan (IRP) is designed to: • Reduce potential direct and indirect financial loss from network intrusions. • Mitigate operational impact from cyber incidents. • Comply with regulatory requirements for information security. • Identify and respond to rogue devices (including wireless access devices)on networks. • Meet industry best practices as published by the FBI and National Infrastructure Protection Center(NIPC). Jende Solutions characterizes cyber incidents as any unwanted, or in some instances, unexplained network or system behavior. Jende Solutions segments these incidents into the following categories consistent with definitions published by the National Infrastructure Protection Center(NIPC): • Increased access to information assets • Unauthorized disclosure of information • Corruption of information • Denial of Service • Theft of IT resources The plan will include: • Roles, responsibilities, and communication strategies in the event of a compromise to include designation of an Incident Response Team (IRT). • Coverage and responses for all critical system components. • Establish a formal process to report incidents and track response activities • Guide response in the following phases: • Preparation • Identification • Containment • Eradication • Recovery • Follow-up/ Lessons Learned • Define escalation processes. • Procedures to conduct a post event review to determine the cause and guide control enhancements. • Procedures for notification, at a minimum, of covered entity and if applicable HHS/OCR. • A strategy for business continuity post compromise. • Reference or inclusion of incident response procedures from the covered entity and if applicable HHS/OCR. • An analysis of legal requirements for reporting compromises as required by State Privacy laws Jende Solutions will ensure: • Integrate event escalation procedures to identify incidents that require declaration of an incident. • Notice will be provided to proper authorities if sensitive data is compromised (See Appendix A for contact numbers).