What to report
An information security “event” is when OYA information is, or is at risk to be, handled or accessed outside normal operations. The information can be in electronic, hard copy, or verbal form.
When an information security event involves information protection; is unwanted, unexpected or accident; shows harm, intent to harm, or significant threat of harm; or the response requires nonroutine action – you need to report it!
(Example: You lost your mobile phone or laptop that contains youth or other restricted information.)
How to report
1. Verbally notify your supervisor or officer-of-the-day (OD).
2. Call the Information Systems Service Desk (503) 378-4333, option 2. You may leave a voicemail.
3. Write a summary of what happened in an email and send it to
ISWorkOrder@oya.oregon.gov. Make sure “Information Security Event” is the subject of the email.
Your email should include:
- The nature of the event (what happened);
- What information is at risk (e.g., youth info, payroll, social security numbers);
- If there is any further risk; and
- What steps have been taken to mitigate the risk, if any.
4. You’re done! The Service Desk has an internal procedure to contact the information security event point of contact (IPOC) about the event. The IPOC will then follow our agency response plan.