UniversalTemplate/logo.png UniversalTemplate/UTS.png

Incident Action Response Tracking Procedures

Topic: Incident Action Response Tracking Procedures
Audience: Staff
Creation Date: March 10th 2014
Author: Dennis Bolton

Purpose:

  • University Technology Services will establish and maintain a procedure for managing media associated with an Incident Action Request (IAR). During the course of an IAR several forms of physical media may be involved, following a path of physically retaining source media, duplicating to similar media, and archiving data to other forms of media.

Media:

  • Media associated with an IAR are either classified as ‘trackable’ or ‘non-trackable’. Examples of trackable media are physical hard drives, portable hard drives, and USB tokens which can be easily identified via serial/model number and later reused. Examples of non-trackable media include DVD-ROMs and CDs, which lack identifying marks and are typically are not suitable for reuse.

Process:

  • All media associated with an IAR must be gathered and maintained for the duration of the event. All media used during an IAR are noted within the case notes for the IAR. However, trackable media are also managed via a GoogleDoc spreadsheet to allow easy identification and allow for reuse once the IAR has been closed.

    The identifying information associated with media, such as manufacturer, model, serial number, and the associated IAR will be documented in a GoogleDoc spreadsheet.

Retention:

  • Due to the potential for ongoing litigation, original media will be retained by UTS or by the individual or department initiating the IAR. The media will be retained until destruction is authorized by the individual or department initiating the IAR. If the Office of Legal Affairs is involved, then that office will authorize the retention period and destruction. To prevent orphaned media, University Technology Services will periodically check with the IAR authorizing contact to verify whether media can be released for reuse or discarded, or if a specific archival date is required. Based on the above, the following schedule will for IAR retention will be observed:
    • SOURCE MEDIA: Until Authorized to Destroy
    • PRISTINE IMAGE: Until Authorized to Destroy
    • WORKING COPIES: 180 Days of IAR inactivity (courtesy email prior to deletion)