IR-9 Information Spillage Response

Description

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Applicability

This Control applies to all Texas A&M-CC information resources. The intended audience for this Control includes all owners and custodians of information resources.

Implementation

TAMU-CC shall respond to information spills by:

Assigning Chief Information Security and Privacy Officer (CISPO) with responsibility for responding to information spills;
Identifying the specific information involved in the system contamination;
Alerting TAMUS Security Operation Center (TAMUS SOC) and Texas Department of Information Resources (DIR) of the information spill using a method of communication not associated with the spill;
Isolating the contaminated system or system component;
Eradicating the information from the contaminated system or component;
Identifying other systems or system components that may have been subsequently contaminated; and
Performing additional actions as deemed necessary by the CISPO.

Revision History

Last Updated: February 21, 2025

Previous Versions:

June 29, 2023
May 31, 2022
March 25, 2021
September 16, 2019