Assistance drafting letter challenging CISO findings.

I am seeking a professional US-Based consultation to evaluate and potentially challenge a significant failure in Information Security governance and Incident Response (IR) at a major R1 university. I am currently navigating a situation involving a persistent, log-evasive intrusion where the institution has leveraged the significant power asymmetry inherent in large bureaucracies to circumvent accountability. I am looking for CISO-level expertise to dismantle a "no record found" defense that was manufactured through intentional administrative delay. **The core pillars of this case include:** * **Failure of Notice:** The institution was provided with explicit, immediate notice of a breach and data loss on 11/27. Despite this "on-notice" status, they remained unresponsive for **150 days**, allowing the forensic window to expire. * **Administrative Misclassification:** Following a formal escalation, the Executive Office misrouted the technical security report to a wellness-focused **"Student Advocacy"** division—a clear departure from NIST SP 800-61 standards. * **Refusal of Forensic Baselines:** The CISO’s office has dismissed high-fidelity technical indicators (including segment hopping and live data purging) and refused to provide a **managed, monitored device** to establish a forensic baseline, relying instead on server-side logs they allowed to age out. I am particularly interested in your help to address the **Administrative Attrition** at play here. The university is currently taking advantage of the time and financial burden required for an individual to procure independent forensic oversight. I require assistance in drafting a formal rebuttal to the University’s General Counsel that frames these failures as **Administrative Spoliation** and a breach of the **Duty of Care.** I have a documented paper trail—including the initial 11/27 notice and the subsequent "Wellness" referral—and would appreciate a brief initial discussion to see if you can provide the expert oversight needed to hold this institution to industry standards. The freelancer must be US based.