Objectives

The purpose of the Technology Data Breach Plan (TDBP) is to enable SAU 39 to respond effectively and efficiently to an actual or suspected data breach involving personally identifiable information (PII), confidential or protected information, SAU identifiable information and other significant cybersecurity incident. The objectives of the TDBP are:

Convene the Incident Response Team (IRT) as necessary.
Validate and contain the data security breach.
Analyze the breach to determine scope and composition.
Minimize impact to the staff and students after a data breach has occurred.
Notification of data owners, legal counsel, state/federal agencies and law enforcement as deemed necessary.

Planning Assumptions

The following planning assumptions were used in the development of the SAU 39 TDBP:

There may be data breaches that will have greater impact than others.
There will be factors that are beyond the department's control or ability to predict during a data breach.
SAU data is backed up.
Some SAU data is hosted by 3rd party providers.

Data Breach/Incident Response Team

SAU 39 has appointed the following people to the data breach/incident response team: Director of Technology, Lead Network/System Administrator, Building Network Administrators, and Technology Supports Specialists.

In the event the TDBP is activated, overall management of the response is delegated to this team. Their primary responsibilities include:

Determine the nature of the data compromised and its impact to staff, students and the SAU.
Communicate impact, the number of affected individuals, the likelihood information will be or has been used by unauthorized individuals and updates of progress to the Superintendent, Assistant Superintendent and Business Administrator.
Coordinate with Superintendent to ensure communication with SAU staff and or parents as deemed appropriate.
Oversight of the TDBP implementation and data breach resolution.
Allocate and manage technology staff resources during the event.
Work with vendors, 3rd party providers, manufacturers, legal counsel, SAU data breach insurance provider, state/federal agencies and law enforcement while correcting the data breach and its repercussions.
Oversight of TDBP implementation debrief.

Activation

The TDBP will be activated in the event of the following:

A data breach has occurred. A data breach includes but is not limited to an incident in which sensitive, protected or confidential data has potentially been viewed, stolen or used by an individual unauthorized to do so.
Personal Health Information (PHI) has been compromised.
Personally Identifiable Information (PII) has been compromised.
Confidential or sensitive data has been compromised.
Network hack/intrusion has occurred.

The Information Security Officer (ISO) will act as the incident response manager (IRM). If the ISO is not able to act as the IRM, a member of the Superintendent’s Leadership Team will assume the role of IRM, with assistance from the IRT. The breach response and reporting process will be documented according to state and federal requirements. The Director of Technology will work with the Superintendent to dispense and coordinate the notification and public message of the breach.

Notification

The following groups will be notified in the event the plan has been activated:

Superintendent
Superintendent's Leadership Team
Technology Staff
SAU and District Staff
Parents and Students
Vendors

Information will be disseminated to the above groups through whichever means of communication deemed appropriate. This could include any one or combination of the following:

Email
Social Media/Website/Communication Subscriptions
Radio or Television
Written Notice
Phone

The TDBP team will work with leadership on which information will be conveyed to each above group, timing of that communication and what means will be used.

Implementation

The TDBP team has the following processes in place to contain the data breach in the least of amount of time possible:

Data inventory of all systems containing sensitive data. A hard copy of this document will be secured at the office of the Director of Technology. An electronic version will be housed on the Technology Group SharePoint site.
Data dictionary of all SAU hosted information systems. A hard copy of this document will be secured at the office of the Director of Technology. Due to non- disclosure agreements, this data may not be available in other locations/formats. The appropriate vendor(s) can be contacted for this information.
Maintained spreadsheet listing all server names, physical and virtual, and their function. A hard copy of this document will be secured at the technology office. An electronic version will be housed on the Technology Group SharePoint site.
Maintained secure application to store all system administrator accounts, passwords and vendor contact information. This will be accessible only to applicable Technology Staff who need access to perform their job functions.
The SAU data backup solution includes the use of a backup manager and off-site file storage, which backs up data locally in the datacenter and offsite.

The following will take place during the incident response:

The members of the IRT will be assembled once a breach has been validated. The IRT will be comprised of the Director of Technology, Lead Network System Administrator, Building Network Administrators, and Technology Supports Specialists. Additional members of the SAU 39 administrative team and technology group may be designated to assist on the IRT.
The IRT will determine the status of the breach, on-going, active, or post-breach. For an active and ongoing breach, the IRT will initiate appropriate measures to prevent further data loss. These measures include, but are not limited to, securing and blocking unauthorized access to systems/data and preserving any and all evidence for investigation.
The IRT will work with the data managers and data owners to determine the scope and composition of the breach, secure sensitive data, mitigate the damage that may arise from the breach and determine the root cause(s) of the breach to devise mitigating strategies and prevent future occurrences.
The IRM will work with legal counsel and the Superintendent’s Leadership Team to determine appropriate course of action pursuant to state statute. This includes notification of the authorities, and local law enforcement.
Collaboration between the authorities and the IRT will take place with the IRM. The IRT will work with the proper authorities to make sure any and all evidence is properly handled and preserved.
On advice from legal counsel, an outside party may be hired to conduct the forensic investigation of the breach. When the investigation has concluded, all evidence will be safely stored, recorded or destroyed (where appropriate).
All affected data, machines and devices will be identified and removed from the network as deemed appropriate for the investigation. Interviews will be conducted with key personnel and facts of the incident will be documented and the evidence preserved for later examination.
The IRT will work with the Superintendent’s office to outline the notification of the data owners and those affected. Communication will be sent out as directed by legal counsel and advised by the SAU administration. The types of communication will include, but not limited to, email, text message, postal mail, substitute notice and/or phone call.
The IRM, in conjunction with the IRT, legal counsel and the Superintendent’s Leadership Team will determine if notification of affected individuals is necessary. Once the determination is made to notify affected individuals, a letter will be written in accordance with all federal and state statutes, and local procedures. If it is determined that identity theft or other fraud is not reasonably likely to occur as a result of the breach, such a determination shall be documented in writing and filed at the Superintendent’s office.

Deactivation

The TDBP team will deactivate the plan once the data breach has been fully contained.

Evaluation

Once the breach has been mitigated an internal evaluation of the SAU 39 TDBP response will be conducted. The IRT, in conjunction with the IRM and others that were involved, will review the breach and all mitigation steps to determine the probable cause(s) and minimize the risk of a future occurrence. Feedback from the responders and affected entities may result in an update to the TDBP and other emergency response plans as appropriate. Information security training programs will be modified to include countermeasures to mitigate and remediate previous breaches so that past breaches do not recur. The reports and incident review will be filed with all evidence of the breach.

School Administrative Unit 39

Data Security & Privacy

Data Security & Data Privacy Guidelines

Data Privacy Agreement - Reviewed May 2021

Appendices

School Administrative Unit 39