Zero-Day Exploit Incident Response Guide for University Disability Services Offices

A suspected zero-day exploit—a previously unknown or unpatched software vulnerability being used to compromise a system—requires a coordinated response. This zero-day exploit incident response guide helps disability services staff report concerns promptly, protect student education records, and preserve evidence while the university’s incident responders investigate.

Follow your university’s incident response plan and instructions from IT security. Staff should report what they observed, not try to confirm or investigate the exploit themselves. NIST’s current incident response guidance describes response as an organizational effort involving preparation, detection, response, and recovery.

How should disability services staff report a suspected zero-day exploit?

Contact the university’s designated IT security or cybersecurity incident reporting channel immediately. If you cannot reach it, use the institution’s approved emergency IT contact or notify your supervisor so they can escalate. A possible zero-day vulnerability should be reported even if you are uncertain whether the device or account is compromised.

Use a trusted device and the university-approved reporting method. Do not forward suspicious files, links, or student information through personal email or public messaging channels. If the affected device is needed to make the report, contact IT security by phone or from another trusted device.

Give staff a clear, limited instruction: stop using the suspected device for routine work and wait for IT security’s directions. Do not independently delete files, uninstall software, restart the device, or attempt to investigate. NIST recommends following an organization’s incident response procedures and coordinating response activities through the appropriate team.

What details should be included in the incident report?

Report observable facts, not guesses. Include when the issue was first noticed, what prompted concern, the device or service involved, and any actions already taken. If a suspected message or alert is involved, describe it and ask IT how to preserve or provide it safely.

• Reporter and contact: Your name, role, department, and a safe way for responders to reach you.
• Device or account: University asset tag, device type, username or account identifier, location, and relevant system or application—without putting passwords or unnecessary student details in the report.
• Timeline and symptoms: Approximate times, unusual messages, unexpected prompts, missing or altered files, or behavior that appeared different from normal.
• Possible exposure: Whether the device displayed, stored, or accessed student education records or other confidential information, and which systems may have been reachable.
• Actions taken: Any connection changes, shutdowns, password changes, scans, or communications made before reporting.

Do not attach student records or extensive logs to a general help-desk ticket unless the incident team specifically requests them through an approved secure channel. For practical data breach guidance, review the Department of Education’s guidance on unauthorized disclosure of student information. The Department explains that unauthorized disclosure can include personally identifiable information from education records becoming available to someone without legal authority, including through a security breach.

How can staff contain the incident while preserving evidence?

Let IT security direct containment. Depending on the circumstances, responders may use endpoint isolation to limit a device’s network access, disable accounts or sessions, or restrict access to a service. Do not disconnect, power off, or reconnect a device on your own unless the incident team instructs you to do so. The right action can depend on the risk of continued access and the need to preserve digital forensic evidence.

Avoid using the suspected device for email, student appointments, or other routine work. Do not run scans or cleanup tools, delete suspicious items, install software, or restart the system unless instructed. Actions that change a device can alter or remove information useful to an investigation. CISA’s digital evidence preservation guidance cautions that system shutdowns and other actions can affect forensic data; responders should weigh evidence preservation against ongoing exposure.

Keep a simple record of what you observed and when. Do not collect or copy data from the device yourself. IT security should determine how to preserve device images, access control logs, and other records, and should control who can access them. NIST’s incident response recommendations provide a current framework for coordinating these activities.

How should teams assess exposure of sensitive student information?

The incident team, privacy officials, and relevant system owners should determine what information may have been accessed, altered, copied, or disclosed. Assessment should include the affected device and connected services, the time period involved, user and administrator access, and available access control logs. A report of possible exposure is not by itself proof that records were viewed or taken.

Disability services teams can help identify the kinds of information and services potentially involved, such as accommodation requests, documentation, appointment communications, or records used to arrange accessible course materials. Share only what the authorized reviewers need, and use approved secure channels. Keep the incident report separate from student case notes unless university policy requires otherwise.

Use the university’s incident severity assessment process to consider the sensitivity and amount of information, the number of students potentially affected, evidence of unauthorized access, and any interruption to essential services. The institution’s privacy officer and counsel should evaluate applicable FERPA, state, contractual, and other requirements. The Department of Education’s data breach guidance explains that FERPA itself does not set a general data-breach notification requirement; other laws or institutional policies may apply.

Who should coordinate the university response?

The university’s designated information security incident lead or response team should coordinate the technical investigation and containment. Disability services staff should use the established reporting channel and avoid directing technical work or making unapproved external statements.

Depending on the incident, the coordinator may involve central IT, the information security office, privacy or FERPA officials, university counsel, records owners, accessibility and disability services leadership, communications staff, and affected service providers. The response lead should establish decision-making authority, assign tasks, and make sure each group receives only the information it needs.

Disability services leadership can help the response team understand the potential impact on accommodations and student access. If systems or appointments are disrupted, identify urgent service needs through an approved continuity process, without sharing confidential details in broad communications. NIST’s incident response guidance emphasizes integrating response into organizational risk management and coordinating relevant roles.

How are affected systems and services restored?

IT security and system owners should decide when affected devices, accounts, and services are safe to restore. Restoration may involve addressing the vulnerability, removing unauthorized access, applying approved updates, rebuilding devices, resetting credentials, and checking system integrity. Do not return a device to university work or reconnect it to protected systems until the responsible team authorizes it.

Before service restoration, confirm that the response team has addressed the known route of compromise and that systems and backups selected for recovery are suitable for use. Bring services back in a controlled order, with additional monitoring as directed. The university should provide staff with a clear status update and instructions about which tools or workarounds are approved.

Work with the incident coordinator to maintain accessible, confidential services while affected systems are unavailable. Use only approved alternatives for appointments and accommodation processes, and avoid moving student information to personal devices or unapproved platforms. NIST’s Guide for Cybersecurity Event Recovery recommends recovery planning that prioritizes important resources and supports continuity of essential functions.

What should a post-incident review document?

After immediate response and service restoration, document the incident timeline, what was affected, decisions made, containment and recovery actions, and the basis for the incident severity assessment. Record who took each action and when, along with the systems, evidence, and access control logs reviewed by authorized responders.

Capture what worked, what caused delays, and what should change in reporting instructions, staff training, access controls, system monitoring, or continuity plans. Include follow-up owners and due dates. Keep the review and supporting materials in the university’s approved, access-restricted incident records; do not copy sensitive investigative details into general departmental files.

A complete review should connect the response to the practical outcomes: whether the exposure was understood, systems were safely restored, and disability services could continue supporting students through approved processes. These findings should inform improvements to the university’s incident response and recovery planning, consistent with NIST’s incident response recommendations.

FAQs

Should staff turn off a device suspected of a zero-day compromise?

Not unless IT security instructs you to. Turning off a device may remove information useful to the investigation, while leaving it connected may also create risk. Stop using it for routine work, report the concern promptly from a trusted channel, and follow the incident team’s instructions about endpoint isolation or other containment.

Can disability services staff run scans on a potentially compromised device?

No. Do not run scans, cleanup tools, or other investigative programs unless the incident team directs you to. They can change device data or complicate evidence collection. Report what you observed and let authorized IT responders examine the device.

Who should be notified if confidential student information may be exposed?

Notify the university’s designated IT security incident channel and your supervisor, who can escalate through the incident response plan. The response coordinator should involve the appropriate privacy or FERPA official, university counsel, and other institutional decision-makers. Do not contact students, families, regulators, or media about possible exposure unless the university’s authorized officials direct you to do so.

How should staff document actions taken during the incident?

Record a factual timeline: what you observed, when it happened, who you notified, and what actions you took or were instructed to take. Note any device or service identifiers that help responders locate the affected resource. Store the record only in the approved incident reporting system, and avoid including unnecessary student information or altering potential evidence.