Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around access control.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Access controls by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Access Control policy and associated access controls;
3.1.2.Review and update Access Control procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Access Control procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Define and document, in consultation with the institution’s ISO and IRM, the types of information system accounts that support organizational missions and business functions;
4.1.2.Assign account manager responsibilities for information system accounts to the respective information owner;
4.1.3.Establish conditions for group and role membership;
4.1.4.Require the respective information owner to specify authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;
4.1.5.Require approval from the information owner for requests to create information system accounts;
4.1.6.Require the respective information custodian to create, enable, modify, disable, and remove information system accounts in accordance with institution-defined procedures and conditions;
4.1.7.Require the respective information custodian to monitor the use of information system accounts;
4.1.8.Notify account managers (i.e., information owners) within an institution-defined period of time for each of the following conditions:
4.1.8.1.When accounts are no longer required;
4.1.8.2.When users are terminated or transferred; and
4.1.8.3.When information system usage or need-to-know changes for an individual;
4.1.9.Require that determinations to authorize access to each information system by the respective information owner are based on:
4.1.9.1.A valid access authorization;
4.1.9.2.Intended system usage; and
4.1.9.3.Other attributes as required by the institution or associated missions/business functions;
4.1.10.Require respective information custodians to review accounts for compliance with account management requirements at least once every two years or more frequently as defined by the component institution;
4.1.11.Require respective information owners and information custodians to establish and implement processes for changing shared/group account credentials (if deployed) when individuals are removed from a group;
4.1.12.Align account management processes with personnel termination and transfer processes; and
4.1.13.Disable accounts within an institution-defined period of time when the accounts:
4.1.13.1.Have expired;
4.1.13.2.Are no longer associated with a user or individual;
4.1.13.3.Are in violation of institutional policy; or
4.1.13.4.Have been inactive for an institution-defined period of time.
5.1.Component institutions must ensure that information systems enforce approved authorizations for logical access to information and system resources in accordance with applicable, institution-defined access control policies.
6.1.Component institutions must:
6.1.1.Identify and document separation of duties of individuals based on institution-defined criteria; and
6.1.2.Require that information owners define information system access authorizations to support separation of duties.
7.1.Component institutions must:
7.1.1.Establish the principle of least privilege as a critical and strategic component of institution-level information security policies and procedures; and
7.1.2.Ensure that access to information systems for users and processes acting on behalf of users is based on the principle of least privilege.
8.1.Component institutions must ensure that each information system:
8.1.1.Enforces an institution-defined limit of consecutive, invalid logon attempts by a user or source of authentication during an institution-defined period of time; and
8.1.2.Automatically performs at least one of the following actions when the maximum number of unsuccessful attempts is exceeded:
8.1.2.1.Locks the account or node for an institution-defined period of time;
8.1.2.2.Locks the account or node until released by an administrator;
8.1.2.3.Delays the next logon prompt according to an institution-defined delay algorithm; and/or
8.1.2.4.Notifies the information custodian.
9.1.Component institutions must ensure that each information system:
9.1.1.Displays to human users at logon interfaces an institution-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, state laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:
9.1.1.1.Users are accessing an institutional information system;
9.1.1.2.Information system usage may be monitored, recorded, and subject to audit;
9.1.1.3.Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and
9.1.1.4.Use of the information system indicates consent to monitoring and recording;
9.1.2.Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and
9.1.3.For publicly accessible information systems that do not have logon interfaces:
9.1.3.1.Displays system use information under institution-defined conditions before granting further access;
9.1.3.2.Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
9.1.3.3.Includes a description of the authorized uses of the system.
10.1.Component institutions must:
10.1.1.Identify and define user actions that can be performed on institutional information systems without identification or authentication consistent with institutional missions and business functions; and
10.1.2.Document and provide supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.
11.1.Component institutions must:
11.1.1.Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
11.1.2.Authorize each type of remote access to each information system prior to allowing such connections.
12.1.Component institutions must:
12.1.1.Establish configuration and connection requirements, and implementation guidance for each type of wireless access; and
12.1.2.Authorize each type of wireless access to each information system prior to allowing such connections.
13.1.Component institutions must:
13.1.1.Establish configuration requirements, connection requirements, and implementation guidance for institution-controlled mobile devices, to include when such devices are outside of institutionally controlled networks; and
13.1.2.Authorize the connection of mobile devices to institutional information systems.
14.1.Component institutions must establish terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:
14.1.1.Access the information system from external information systems; and
14.1.2.Process, store, or transmit institution-controlled information using external information systems.
15.1.Component institutions must:
15.1.1.Designate individuals authorized to make information publicly accessible;
15.1.2.Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
15.1.3.Review the proposed content of information prior to posting onto publicly accessible information systems to ensure that nonpublic information is not included; and
15.1.4.Review the content on the publicly accessible information system for nonpublic information at institution-defined frequencies and remove such information, if discovered.