Michigan Institute of Real Estate — Security Incident & Data Breach Response Policy
Purpose
Michigan Institute of Real Estate maintains this policy to provide a consistent process for responding to suspected or confirmed security incidents involving personal, student, or customer information.
1. Identification and Containment
Upon becoming aware of a suspected security incident, our technology team will promptly investigate the incident and take reasonable steps to contain it. This may include isolating affected servers, systems, accounts, or services and restricting access as necessary.
2. Investigation
The technology team will determine, to the extent reasonably possible:
- What systems or information were affected
- What information may have been accessed, acquired, altered, or disclosed
- When the incident occurred and how long it persisted
- Which users, customers, or organizations may have been affected
- The cause of the incident and steps necessary to prevent further unauthorized access
3. Remediation
Appropriate corrective action will be taken based on the nature of the incident. This may include securing or disabling affected accounts, changing credentials, patching or updating systems, restoring data from backups, modifying access controls, and addressing identified vulnerabilities.
4. Notification
If an incident involves personal or student information, Michigan Institute of Real Estate will notify affected customers, organizations, and/or individuals without unreasonable delay and in accordance with applicable law and contractual requirements.
When Michigan Virtual data is involved, Michigan Virtual will be notified promptly after confirmation of a reportable security incident, and we will cooperate with Michigan Virtual regarding investigation, remediation, and required notifications.
5. Documentation
Material security incidents will be documented, including the nature of the incident, systems or information affected, actions taken to contain and remediate the incident, notifications made, and measures implemented to reduce the likelihood of recurrence.
6. Responsibility
The Michigan Institute of Real Estate technology team is responsible for coordinating technical investigation, containment, and remediation. Management is responsible for coordinating required customer, partner, regulatory, or legal notifications.
Security Incidents
Michigan Institute of Real Estate maintains procedures for responding to suspected or confirmed security incidents involving personal or student information. For additional information, please see our Security & Data Incident Response Policy.
Effective Date: September 4, 2026