SOP for Managing Phishing/Ransomware Attempts

[Christopher Jones <Christopher.Jones () UFV CA>]

We are looking at revamping our current procedures for managing phishing and ransomware attempts.  What we have in 
place now is fairly informal, but are looking to develop a more formal plan.  If anyone has gone through this process 
and would be willing to share, that would be most appreciated.  Specifically, we could use information such as:

     1. Thresholds for when to generate general university-wide alerts
     2. Number of phishing messages received before a "search and destroy" operation is implemented to remove malicious 
messages from inboxes

Thanks.

Christopher Jones
IT Security Analyst
University of the Fraser Valley
Christopher.Jones () ufv ca