Reporting a Security Incident - definitions

Overview

When reporting a security incident, it’s important to understand key terms. Incidents may involve compromised systems, accounts, or personal information. Users must act quickly and follow proper reporting procedures to protect university data and resources. The following are terms and procedures account holders should understand to Report An Incident involving the university account or computer system.

Personal Information (PII)

Personally Identifiable Information (PII) is any information about a person that is maintained by an agency and can be linked to an individual. There are three classifications of PII:

1. Confidential: Legally or policy-protected data.
2. Restricted: Internal university information not for public disclosure.
3. Public: Information intended for public use,  and there is no expectation of privacy or confidentiality.

• Nonpublic Personal Information (NPII subsection): Financial and sensitive personal data (e.g., SSN, bank account).

Never share your password or PIN. Protect personal data with a strong password.

Compromised System

A compromised system is a computer (laptop or desktop) that is behaving abnormally, indicating that it may be affected by a bad actor or a virus. It can be difficult to detect if a system has been compromised. Take the following steps if a compromised system is suspected:

• Stop using the system (don’t power it off).
• Disconnect from the network/Wi-Fi.
• Report the incident immediately.

Compromised Account

A compromised account is an account that has been affected by a bad actor (i.e., someone other than the account holder) who has gained access to a student or employee account.

1. Signs include suspicious emails sent from your address, altered financial info, or unexpected login activity.
2. Often caused by phishing scams.
3. Report immediately to the Technology Support Center: tsc@ucmo.edu | 660-543-4357.

Acceptable Use Policy (AUP)

The Acceptable Use Policy is the framework for the acceptable use of all Information Technology at the University of Central Missouri.

1. Applies to and must be observed by all employees, students, and visitors. Account holders have a responsibility to protect their account from unauthorized use.
2. Violations (e.g., data theft or unauthorized disclosure) may result in disciplinary action. The AUP outlines the scope and procedures of the policy as well as the compliance expected from all users.
3. Report violations (e.g., theft, loss, or unauthorized disclosure of protected and classified information) to: tsc@ucmo.edu | 660-543-4357.