Search Google Appliance

Failure by MIT to report any data incident involving regulated data in a timely manner may be a violation of state or federal law. Regulatory data breaches require notifying all affected individuals. It can also lead to financial repercussions: In a 2010 annual study by Ponemon Institute and Symantec Corp., they put the price of a data leakage at $7.2 million, or $214 per compromised record.

Know the steps to take in the event of a security incident involving MIT business data. If in doubt, report the incident first by contacting MIT's IT Security Team. It's better to report when no breach occurred, than to not report and be sorry later.

Electronic data breaches

If an IT security incident has occurred involving electronic MIT business data of any kind, take the following steps:

  • ISOLATE the computer(s) involved from the campus network. To preserve useful evidence of the incident, DO NOT POWER OFF the computer(s) or device(s) if at all possible. Disconnect the computer(s) from the network by unplugging their network cables, if they are connected, and disabling or turning off any wireless connections.
  • NOTIFY the MIT Data Incident Response Team as soon as possible by sending e-mail (if possible) to infoprotect@mit.edu.
  • CONTACT your local or designated IT support professional, whomever is responsible for the computer(s) and device(s) involved. This individual, or their designee, is responsible for initial response.
  • PROVIDE the Incident Report details as outlined below to infoprotect@mit.edu.

Paper data breaches

If a security incident has occurred involving MIT business data of any kind, take the following steps immediately:

  • SECURE the area in which the incident has occurred. If the paper records are still on hand - although their content may have been disclosed - move them to a secure location for use later in the incident response process.
  • NOTIFY the MIT Data Incident Response Team by sending email (if possible) to infoprotect@mit.edu
  • INFORM your supervisor and/or appropriate department, lab or center management
  • DETERMINE who will communicate the incident.
  • PROVIDE the Incident Report details as outlined below to infoprotect@mit.edu.