This report is based on information risk reviews of incident management and reporting that were carried out at 16 universities from April 2017 to March 2018.