Report a Computer Security Incident


When a security incident takes place, there are specific steps to take when working with the Computer Incident Response Team (CIRT).

Critical Concepts

The CIRT process is used for reporting significant security events, such as the following:

If you are a system administrator, working with the CIRT will

Departments with internal incident response teams are still required to contact the CIRT in case of incident. The CIRT will work closely with your security team to investigate the incident.

If you are not a system administrator and suspect a violation of your computer's security has occurred, contact your department's technical support person immediately. After hours, call the ITS Service Desk, (858) 246-4357 or extension 6-HELP.

Steps to Take

1. Don't touch the machine or system

2. Find out what constitutes a CIRT incident

A CIRT security incident occurs when an unauthorized entity gains access to UC San Diego computing or network services, equipment, or data. Typical situations include:

3. Request assistance from IT Services Security

Report any incident you consider a possible threat. Contact the IT Service Desk, (858) 246-4357 or extension 6-HELP. The Help Desk will contact the on-call CIRT representativeto respond. The earlier you contact the CIRT, the more likely it is that the CIRT will be able to help.

4. Cooperate with the CIRT

The CIRT will work with you to:

The CIRT cannot assist with cleanup and data recovery, except as they pertain to the situations above. 

If you still have questions or need additional assistance, please contact the ITS Service Desk. You can call us at (858) 246-4357, email us at, or submit a ticket at