This is the University of Oregon policy that establishes the Data Security Incident Response (DSIR).