Grasslands Public Schools Policy Handbook Grasslands Public Schools
Sign in
Home
Administrative Procedure

AP-321 — Information Security Incident Response

Section Three: General School Administration
Effective Date: August 25, 2026 Last Reviewed: August 25, 2026

Background

Information security incidents at educational institutions can affect critical operations and personal information protected under the Protection of Privacy Act (POPA). Grasslands Public Schools maintains information systems including student information systems, financial platforms, and communication tools that are essential to Division operations and that hold personal information.

This Administrative Procedure establishes the governance framework for responding to information security incidents. It defines incident classification criteria, escalation authorities, notification requirements, and integration with privacy breach obligations under POPA. This procedure operates in conjunction with IM-003 – Incident Response Plan, which provides the technical and operational runbook for incident response activities. A.P. 321 establishes the authorities, timelines, and decision frameworks; IM-003 provides the step-by-step operational procedures executed by the Computer Incident Response Team.

Scope

This procedure applies to all information security incidents affecting Division information systems, data, or operations, including incidents originating from third-party service providers. It applies to all employees, contractors, and service providers who detect, report, or respond to security incidents.

Systems connected to provincial repositories, including PowerSchool and PASIprep, are subject to additional incident response requirements under the PASI Usage Agreement. These requirements are documented in SI-001 – PASI Security Controls Compliance.

Definitions

Terms not defined in this procedure have the meanings assigned in Policy 310 – Information Security Charter and Policy 311 – Privacy and Access to Information.

Affected Individual: A person whose personal information has been or may have been subject to unauthorized access, collection, use, disclosure, or disposal as a result of a privacy incident.

Computer Incident Response Team (CIRT): The team responsible for executing incident response activities as defined in IM-003 – Incident Response Plan.

Incident Commander: The individual with overall authority and responsibility for managing a specific incident. For Major Risk incidents, this is the Superintendent or designate. For all other incidents, this is the Director of Technology or designate.

Privacy Incident: A security incident involving the unauthorized access, collection, use, disclosure, or disposal of personal information, whether intentional or unintentional.

Real Risk of Significant Harm (RROSH): The threshold under POPA that triggers mandatory notification to affected individuals and the Office of the Information and Privacy Commissioner. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on credit record, and damage to or loss of property.

Security Event: An observable occurrence in a system or network that may indicate a security incident. Events require investigation but may not constitute incidents.

Security Incident: A confirmed or suspected violation of security policies, acceptable use policies, or standard security practices. This includes unauthorized access, denial of service, malicious code, and improper usage.

Vendor Security Incident: A security incident affecting a third-party service provider that stores, processes, or transmits Division data, or that may impact Division systems or operations.

Responsibilities

Superintendent

The Superintendent serves as Incident Commander for Major Risk incidents and holds ultimate accountability for the Division's incident response posture.

Access and Privacy Coordinator

The Access and Privacy Coordinator (as defined in Policy 311) has independent authority for privacy-related determinations and works in coordination with the Incident Commander.

Director of Technology

The Director of Technology serves as Incident Commander for Moderate and Minor Risk incidents and as Incident Handler for most incidents as defined in IM-003.

Communications Manager

The Communications Manager is responsible for all external communications regarding incidents.

System Owners (as defined in A.P. 312)

All Staff

Procedures

1. Incident classification

  1. All security incidents shall be classified according to the following criteria, which align with IM-003 – Incident Response Plan. Classification determines escalation requirements, notification obligations, and response timelines.
Level Criteria Examples
Major Risk Restricted data likely accessible to unauthorized individuals; potential for physical harm; reasonable expectation of significant theft or fraud; may constitute a criminal offense; compromise of additional systems; active, ongoing attack; ransomware or destructive malware; complete loss of critical services; likely media or regulatory attention Active ransomware encryption; confirmed data breach with student records; threat actor with administrative access; SIS or email completely unavailable; compromised administrator account; malware on multiple endpoints; unauthorized access to HR system; successful business email compromise attempt
Moderate Risk Policy violation with potential data exposure; contained malware infection; lost or stolen device (encrypted); non-critical system compromise; suspected but unconfirmed breach; personal information may have been compromised Single endpoint malware (contained); lost encrypted laptop; unauthorized software installation; suspicious login from unusual location; misdirected email containing personal information
Minor Risk Minor policy violation; failed attack attempts; no data exposure; minimal operational impact Blocked phishing attempt; minor acceptable use violation; unsuccessful brute force attempt; spam outbreak
  1. If it is reasonable to expect that personal information was compromised, the incident shall be classified as at least Moderate Risk.

a. Privacy Incident Classification

  1. When a security incident involves personal information, a parallel privacy classification shall be made to determine POPA notification obligations. A privacy incident exists when personal information has been or may have been subject to unauthorized access, collection, use, disclosure, or disposal.
  2. If a privacy incident is identified, the Access and Privacy Coordinator shall be notified immediately and a Real Risk of Significant Harm (RROSH) assessment shall be conducted (see Section 5).

b. Reclassification

  1. Incidents may be reclassified as additional information becomes available. Reclassification to a higher level triggers the escalation requirements for that level immediately. Reclassification to a lower level does not reverse notifications already made.

2. Roles and authorities

a. Incident Commander

  1. For Major Risk incidents, the Incident Commander is the Superintendent or, in their absence, the Assistant Superintendent.
  2. For Moderate Risk and Minor Risk incidents, the Incident Commander is the Director of Technology or designate as specified in IM-003.
  3. The Incident Commander has authority to activate the CIRT, authorize containment actions including service interruptions, authorize engagement of external resources, and approve internal communications.

b. Access and Privacy Coordinator

  1. The Access and Privacy Coordinator shall be notified immediately when any incident involves or may involve personal information.
  2. The Access and Privacy Coordinator has authority to conduct RROSH assessments and determine POPA notification requirements.
  3. The Access and Privacy Coordinator has authority to authorize notifications to affected individuals and the Office of the Information and Privacy Commissioner.
  4. The Access and Privacy Coordinator works in coordination with the Incident Commander but has independent authority for privacy-related determinations.

c. Director of Technology

  1. The Director of Technology serves as Incident Handler for most incidents as defined in IM-003.
  2. The Director of Technology is responsible for initial classification and escalation decisions.
  3. The Director of Technology has authority to engage external technical resources for incident support.
  4. The Director of Technology is responsible for technical evidence preservation and forensic coordination.

d. Communications Manager

  1. The Communications Manager is responsible for all external communications regarding incidents, including communications to parents, students, and media.
  2. All external communications shall be approved by the Incident Commander prior to release.
  3. For privacy incidents requiring notification to affected individuals, the Communications Manager coordinates with the Access and Privacy Coordinator on notification content.

e. Ransomware Payment Authority

  1. Any decision to pay a ransom demand requires authorization from both the cyber insurance carrier (Marsh) and the Board of Education.

3. Escalation requirements

  1. The following escalation timelines apply from the point of initial classification. All timelines represent maximum intervals; earlier notification is encouraged when circumstances warrant.
Level Superintendent Board Chair Access and Privacy Coord. Cyber Insurance OIPC / Minister
Major Risk Within 1 hour Within 4 hours Immediate (if PI involved) Within 24 hours Per RROSH
Moderate Risk Within 24 hours As needed Within 24 hours (if PI involved) As needed Per RROSH
Minor Risk Periodic summary N/A N/A N/A N/A

a. Cyber Insurance Notification

  1. The Division's cyber insurance policy requires prompt notification of incidents that may result in a claim.
  2. For Major Risk incidents, the Director of Technology or Superintendent shall contact Marsh within 24 hours of incident classification.
  3. Insurance notification should occur before engaging external forensic or legal services to ensure coverage and access to panel resources.
  4. Legal counsel services are available through the cyber insurance policy and should be engaged through Marsh for incidents with potential legal exposure.

b. Law Enforcement Engagement

  1. Law enforcement engagement requires authorization from the Superintendent or, for Major Risk incidents, the Incident Commander.
  2. Law enforcement should be engaged when the incident involves a suspected criminal offense, there is an imminent threat to physical safety, or ransomware or extortion is involved.
  3. The School Resource Officer may be consulted for guidance but is not the primary law enforcement contact for cyber incidents. Contact local police services directly for criminal matters.

4. Vendor security incidents

When a third-party service provider notifies the Division of a security incident affecting Division data, the following process applies.

a. Vendor Breach Notification

  1. The recipient of the notification shall immediately notify the Director of Technology, who shall classify the incident according to Section 1.
  2. If personal information is involved, the Access and Privacy Coordinator shall be notified immediately.
  3. The Director of Technology shall request from the vendor:
    1. The scope of the incident.
    2. The specific Division data affected.
    3. The timeline of unauthorized access.
    4. Containment and remediation actions taken.
    5. Whether other customers were affected.
  4. The Division retains responsibility for POPA notifications even when the incident originated with a vendor. The Access and Privacy Coordinator shall conduct a RROSH assessment based on information provided by the vendor.

b. Division Response to Vendor Incidents

  1. Upon notification of a vendor incident, the Director of Technology shall assess whether any Division-side containment actions are required, such as password resets, token revocation, or temporary service suspension.
  2. The Director of Technology shall document the vendor's response and remediation actions for the incident record.
  3. Following a significant vendor incident, the Director of Technology shall assess whether the vendor relationship should continue and make a recommendation to Senior Administration. This assessment shall be coordinated with the vendor risk management processes in A.P. 322 – Third-Party and Vendor Risk Management.

5. Privacy incident procedures

a. Identification of Privacy Incidents

  1. A privacy incident occurs when personal information has been or may have been subject to unauthorized access, collection, use, disclosure, or disposal. This includes but is not limited to:
    1. Unauthorized access to systems containing student or staff records.
    2. Misdirected emails or faxes containing personal information.
    3. Lost or stolen devices containing unencrypted personal information.
    4. Ransomware attacks where personal information may have been accessed or exfiltrated.
    5. Vendor breaches affecting Division data.
    6. Improper disposal of records containing personal information.

b. Real Risk of Significant Harm (RROSH) Assessment

  1. When a privacy incident is identified, the Access and Privacy Coordinator shall conduct a RROSH assessment to determine notification obligations under POPA. The assessment shall consider factors indicating significant harm and factors indicating probability of harm.
  2. Factors indicating significant harm:
    1. Sensitivity of the personal information (financial, health, information about minors).
    2. Potential for identity theft or fraud.
    3. Potential for physical harm or stalking.
    4. Vulnerability of affected individuals (students, particularly younger children).
    5. Potential for humiliation, damage to reputation, or relationship harm.
  3. Factors indicating probability of harm:
    1. Evidence that information was actually accessed (vs. potential access).
    2. Evidence that information was exfiltrated or published.
    3. Whether information was encrypted.
    4. Apparent motive of the threat actor.
    5. Whether the recipient of misdirected information is known and trusted.
  4. The RROSH assessment and its rationale shall be documented and retained with the incident record. The detailed RROSH determination process is set out in IM-022 – Determining Real Risk of Significant Harm.

c. OIPC and Minister Notification

  1. When the RROSH assessment determines that there is a real risk of significant harm, the Access and Privacy Coordinator shall notify the Office of the Information and Privacy Commissioner and the Minister of Technology and Innovation without unreasonable delay, as required under POPA.
  2. Notification to the OIPC and the Minister shall include:
    1. A description of the incident.
    2. The types of personal information involved.
    3. The approximate number of affected individuals.
    4. An assessment of the risk of harm.
    5. The steps taken to mitigate harm and prevent recurrence.
  3. In cases of uncertainty about whether the RROSH threshold is met, the Access and Privacy Coordinator may consult with the OIPC before making a formal determination.

d. Notification to Affected Individuals

  1. When the RROSH threshold is met, the Division shall notify affected individuals without unreasonable delay.
  2. Notification shall be direct (mail, email, or phone) to each affected individual or, for students, to their parent or guardian.
  3. Notification shall include:
    1. A description of the incident.
    2. The types of personal information involved.
    3. The steps the Division has taken in response.
    4. Steps the individual can take to protect themselves.
    5. Contact information for questions.
  4. The Communications Manager shall coordinate notification logistics in consultation with the Access and Privacy Coordinator.
  5. Notification may be delayed if a law enforcement agency advises that notification would impede a criminal investigation, but only for the period specified by the agency.

6. Documentation and reporting

a. Incident Documentation

  1. All incidents shall be documented using the Incident Log Template in IM-003 Appendix A.
  2. For privacy incidents, documentation shall also include:
    1. The RROSH assessment and rationale.
    2. OIPC notification (if made) and any OIPC response.
    3. Affected individual notification (if made).
    4. Records of any delayed notification and the reason for delay.
  3. Incident records shall be retained for a minimum of seven years.

b. Post-Incident Review

  1. All Major Risk incidents shall be subject to a post-incident review following the template in IM-003 Appendix C.
  2. The post-incident review shall be completed within 30 days of incident closure.
  3. Recommendations from post-incident reviews shall be tracked to completion by the Director of Technology.

c. Senior Administration and Board Reporting

  1. The Director of Technology shall provide periodic incident summaries to Senior Administration, including:
    1. Total incidents by classification level.
    2. Privacy incidents and OIPC notifications.
    3. Lessons learned and improvements implemented.
    4. Recommendations for policy or resource changes.
  2. The Superintendent shall determine whether incident summaries or portions thereof should be presented to the Board.

7. Training and testing

a. CIRT Training

  1. CIRT members shall maintain familiarity with current incident response procedures, including this procedure and IM-003.
  2. The Access and Privacy Coordinator shall maintain familiarity with current breach notification requirements.
  3. Training completion shall be documented per A.P. 327 – Security Awareness and Training.

b. Tabletop Exercises

  1. The Division shall conduct tabletop incident response exercises as required to maintain incident response readiness.
  2. Exercises should include scenarios involving privacy breaches to test the integration of security and privacy response procedures.
  3. The Superintendent or designate is encouraged to participate in tabletop exercises.
  4. Lessons learned from exercises shall be incorporated into procedure updates.
  5. Delivery, scheduling, and documentation of CIRT training and tabletop exercises shall follow the operational procedures in A.P. 327 – Security Awareness and Training and IM-018 – Security Awareness Training Delivery.

Review

This procedure shall be reviewed every three years by the Director of Technology, or earlier if triggered by:

Cross reference

Legal reference