The purpose of this policy is to establish procedures to prepare and respond to data breach incidents including the determination of the systems or applications affected, if data has been corrupted, what specific data was compromised, and what actions are required for forensic investigation and legal compliance. Federal and state statutes require the notification of governmental agencies and affected individuals when there is reason to believe that legally protected data held by or for the University in certain circumstances was acquired by someone without valid authorization.
Any suspected or confirmed compromise of protected electronic data must be reported to the it-security@ldeo.columbia.edu or file a ticket with askit@ldeo.columbia.edu. The office of Research Computing and Campus Infrastructure will notify the appropriate system manager. Any individual responsible for a system containing protected data that may have been compromised must take immediate steps to secure that system and preserve it without change according to the appended procedure.