Learn what counts as an IT security incident at NCU, what to do if a device is involved, and how to report an incident, including what to include and what happens next.
When in doubt, report it
A security incident is anything that puts NCU accounts, devices, or information at risk, whether it actually happened or was only attempted. Report it as soon as you suspect something. You don't need to be sure. A false alarm costs a few minutes; a delay can cost far more.
Reporting is required of all faculty, staff, students, and contractors under NCU's Data Breach Notification policy.
What counts as an incident
Your account and devices |
Data and information |
- You clicked a phishing link or entered your password on a suspicious page
- You approved an MFA prompt you didn't start
- Someone else is using your account, or you see sign-ins you don't recognize
- A laptop, phone, or tablet with NCU email or files is lost or stolen, including personal devices
- Your computer shows signs of malware or a ransom message
|
- You emailed or shared sensitive information with the wrong person
- Someone accessed records they shouldn't have
- Paper records with personal information are lost, stolen, or left unsecured
- Someone asked you to share your password, or you shared it
- You notice something that just doesn't look right
|
Sensitive information includes Social Security numbers, financial and credit card numbers, student records, medical information, and anything else that identifies a specific person. It counts whether it's digital, on paper, or spoken.
Where to start
If… | Start here |
I clicked a phishing link, signed in, or sent money | |
Someone else is in my account | |
My computer may be infected, or I see a ransom message | |
Something else, or I'm not sure | |
If a device is involved
Don't use it, don't fix it
- Stop using the device.
- Disconnect it from the network. Turn off Wi-Fi or unplug the network cable.
- Leave it powered on until OIT tells you otherwise.
- Don't try to clean or repair it. That can destroy the evidence needed to find out what happened.
- Report from a different device, or call.
How to report
Report it |
What to include |
- Submit the Information Security Incident form.
- Can't use the form? Email incident@northcentral.edu.
- Urgent, or can't use email? Call the IT Service Desk at 612.343.4170.
Also tell your supervisor.
|
- What happened, briefly
- The type of information involved, described in general terms
- Your department
- Your contact information
Don't put sensitive information in the report itself. OIT will contact you for details.
|
Immediate danger? Call 911 first.
What happens next
What happens next
OIT investigates every report and will contact you for details. Keep the device and any related messages as they are until then.
Don't notify affected people yourself. If personal information was exposed, university Information Security decides whether notification is required and handles it. See the Data Breach Notification policy.