8-Attachment 2 - Security Incident Report for Contractors and Vendors.pdf

SECURITY INCIDENT REPORT

For Contractors or Vendors

CONFIDENTIAL when filled out (Section 2059.55 TGC & Section 552.139 TGC) Rev. 04-24-2017 Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors Page 1 of 5

To immediately report an incident please contact:

Celerino Torres Chief Information Security Officer Celerino.torres@oag.texas.gov Office (832) 693-0888

Instructions: Each Contractor or business partner (Contractor) is required to provide timely reporting of security incidents to the Office of the Attorney General, Child Support Division (OAG-CSD) Information Security Officer (ISO). Together, the Contractor and OAG-CSD ISO will assess the significance and criticality of a security incident based on the business impact to affected resources and the current and potential effect of the incident (e.g., loss of access to services, revenue, productivity, reputation;

unauthorized disclosure of confidential or private information; loss of data or network integrity; or propagation to other networks).

Depending on the criticality of the incident, it will not always be feasible to gather all the information prior to reporting to OAG-CSD. In such cases, incident response teams should make an initial report and then continue to report information to the OAG-CSD daily until the incident has been resolved and the OAG- CSD ISO has closed the incident. All security incident reports provided to OAG-CSD will be classified and handled as Confidential per Section 2059.055 Texas Government Code (TGC) and Section 552.139 Texas Government Code.

1. Contact Information Company Name:

Full Name:

Job Title:

Division or office:

Work phone:

Mobile phone:

E-mail address:

Fax number:

Additional contact information: (e.g., subject matter experts; incident response team members) Area of Specialty Name Email Phone #

Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors Page 2 of 5

2. Type of Incident (Check all that apply)

Account compromise (e.g., lost password) Denial of service (including distributed) Malicious code (e.g., virus, worm, Trojan) Misuse of systems (e.g., acceptable use) Reconnaissance (e.g., scanning, probing)

Social engineering (e.g., phishing, scams) Technical vulnerability (e.g., 0-day attacks) Theft/loss of equipment/media/document Unauthorized access (e.g., systems, devices) Unknown/Other (Please describe below)

Description of incident:

3. Scope of Incident (Check one)

Critical (e.g., affects public safety or Federal/State/Individual confidential or private information) High (e.g., affects Contractor’s entire network or critical business or mission systems) Medium (e.g., affects Contractor’s network infrastructure, servers, or admin accounts) Low (e.g., affects Contractor’s workstations or standard user accounts only) Unknown/Other (Please describe below)

Estimated number of systems affected:

(e.g., workstations, servers, mainframes, applications, switches, routers)

Estimated number of users and/or customers affected:

Third-parties involved or affected:

(e.g., vendors, contractors, partners)

Additional scope information:

4. Impact of Incident (Check all that apply)

Loss of access to services Loss of productivity Loss of revenue Loss of reputation

Propagation to other networks Unauthorized disclosure of data/information Unauthorized modification of data/information Unknown/Other (Please describe below)

Estimated total cost incurred:

(e.g., cost to contain incident, restore systems, notify data owners, notify customers, credit monitoring fees, fines)

Additional impact information:

5. Sensitivity of Affected Data/Information (Check all that apply) Confidential/Sensitive/IRS data/info Financial data/info

Personally identifiable information

(PII/PHI)

Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors Page 3 of 5

Non-sensitive data/info Publicly available data/info

Intellectual property/copyrighted data/info Critical infrastructure/Key resources Unknown/Other (Please describe below)

Quantity of data/information affected:

(e.g., file sizes, number of records)

Describe the data and/or information that may have been compromised:

6. Users and/or Customers Affected by Incident (Provide as much detail as possible)

Number of affected Users Number of affected Customers

User Name User Job Title System access levels or rights of affected users:

(e.g., regular user, domain administrator, root)

Additional User and/or Customer details:

7. Systems Affected by Incident (Provide as much detail as possible) Attack sources (e.g., IP address, port):

Attack destinations (e.g., IP address, port):

IP addresses of affected systems:

Domain names of affected systems:

Primary functions of affected systems:

(e.g., web server, domain controller)

Operating systems of affected systems:

(e.g., version, service pack, configuration)

Patch level of affected systems:

(e.g., latest patches loaded, hotfixes)

Security software loaded on affect systems:

(e.g., anti-virus, anti-spyware, firewall, versions, date of latest definitions)

Physical location of affected systems:

(e.g., state, city, building, room, desk)

Additional system details:

Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors Page 4 of 5

8. Remediation of Incident (Provide as much detail as possible – include dates) Actions taken by Contractor to identify affected resources:

contain & investigate incident:

remediate incident:

verify successful remediation:

(e.g., perform vulnerability scan, code review, system tests)

Actions planned by Contractor to prevent similar incidents:

(provide timeline)

Additional remediation details:

9. Timeline of Incident (Provide as much detail as possible)

a. Date and time when Contractor first detected, discovered, or was notified about the incident:

b. Date and time when the actual incident occurred:

(estimation if exact date and time unknown)

c. Date and time when the incident was contained, or when all affected systems or functions were restored:

(use whichever date and time is later)

d. Elapsed time between the incident and discovery:

(e.g., difference between a. and b. above)

e. Elapsed time between the discovery and restoration:

(e.g., difference between a. and c. above)

Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors Page 5 of 5

Detailed incident timeline:

Date Time Event/Action/Comment

10. Miscellaneous / Lessons Learned (Provide any other relevant information)

11. List of Attachments (Include the name and date of each attachment)

Please submit the completed form, attachments and all updates to:

Celerino Torres Celerino.Torres@oag.texas.gov

*PLEASE NOTE:

• All Security Incident Reporting Forms and accompanying documentation must be transmitted to OAG-

CSD in a safe and secure manner.

• Please encrypt all documents prior to transmission.

• Please contact the ISO via phone to coordinate your fax transmission or decryption password.

“Upon discovering a possible improper inspection or disclosure of FTI, including breaches and security incidents, by a federal employee, a state employee, or any other person, the individual making the observation or receiving information must contact the office of the appropriate special agent-in-charge, TIGTA immediately, but no later than 24 hours after identification of a possible issue involving FTI. Call the local TITGA Field Division Office first.” “Concurrent to notifying TIGTA, the agency must notify the Office of Safeguards by email to Safeguards mailbox, safeguardreports@irs.gov.” (IRS publication 1075 §10.1)

If criminal action is suspected (e.g., violations of Chapter 33, Penal Code, Computer Crimes, or Chapter 33A, Penal Code, Telecommunications Crimes) the Contractor is also responsible for contacting the appropriate law enforcement and investigative authorities.

mailto:Celerino.Torres@oag.texas.gov mailto:safeguardreports@irs.gov