HOME / REQUIREMENTS /

Reporting breaches

SB10: Server and application operators must promptly inform the appropriate escalation contacts of any possible breaches, whether the system is managed directly by Harvard or via contract with a third-party service provider for Harvard's use (e.g. IaaS, SaaS).

See also: Level 3, Level 4, 14, Servers B, Level 3, Level 4

How to Comply

Report possible breach, loss or theft of confidential information

Follow instructions posted on the Information Security Website to start the incident reporting process. The University CISO and the OGC will be informed as appropriate of any known or suspected breach of a server containing confidential information. In addition, the University maintains a whistleblowing policy. The policy is intended to encourage all members of the Harvard community to report suspected violations of law or Harvard...

Read more about Report possible breach, loss or theft of confidential information