Other title: Incident response policy 2100-07

[Updated].; "Revision history: 12/01/2009: New policy for DAS, replaces OIT policy dated 11/02/07. 12/05/2012: Policy reissued under Director Robert Blair. 10/10/2017: Policy updated to reflect current incident response practices and the content was moved into the current policy template"--Page 12.; "Effective date: 10/10/2017 ... Replaces policy dated: 12/5/2012."; Policy number: 2100-07.; Includes bibliographical references.The purpose of this policy is to define the requirements for an enterprise and an Ohio Department of Administrative Services (DAS) information security and privacy incident response capability. A glossary of terms found in this policy is located in Section 8.0 Definitions. In addition, references to National Institute of Standards and Technology Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," family identifiers and control numbers are provided in parentheticals next to requirement headers, where applicable. This policy defines the requirements necessary to provide a coordinated information security incident response for all of DAS. The requirements of this policy apply to all DAS programs and include all DAS-managed system assets. The policy also applies to all DAS business unit managers as well as system and service owners