Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around assessment, authorization, and monitoring.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Security Assessment, Authorization, and Monitoring controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Security Assessment, Authorization, and Monitoring policy and associated controls;
3.1.2.Review and update Security Assessment, Authorization, and Monitoring procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Assessment, Authorization, and Monitoring procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Develop a control assessment plan that describes the scope of the assessment including:
4.1.1.1.Controls and control enhancements under assessment;
4.1.1.2.Assessment procedures to be used to determine control effectiveness; and
4.1.1.3.Assessment environment, assessment team, and assessment roles and responsibilities;
4.1.2.Ensure the control assessment plan is reviewed and approved by the authorizing official or the authorizing official’s designated representative prior to conducting the assessment;
4.1.3.Assess the controls in the information system and its environment of operation on a recurring frequency established by the institution’s ISO to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
4.1.4.Produce a control assessment report that documents the results of the assessment; and
4.1.5.Provide the results of the control assessment to appropriate personnel including information owners and information custodians.
4.2.Component institutions must ensure that a review of the institution’s information security program for compliance with security standards set by the Texas Department of Information Resources is performed at least biennially, based on institutional risk management decisions. The review must be performed by individual(s) independent of the institution’s information security program and designated by the institution’s head or their designated representative(s).
5.1.Component institutions must:
5.1.1.Through relevant information system owners, authorize the exchange of information (i.e., interconnections) between institutional information systems and other information systems, including those external to the institution;
5.1.2.Use a formalized Interconnection Security Agreement to document interconnections. At minimum, Interconnection Security Agreements must include the following information for each information system:
5.1.2.1.Interface characteristics;
5.1.2.2.Security requirements, controls, and responsibilities;
5.1.2.3.Information system category; and
5.1.2.4.The nature of the information communicated, including data classification.
5.1.3.Regularly review and update as necessary established Interconnection Security Agreements at the time of periodic risk assessments or at an institution-defined frequency.
6.1.Component institutions must:
6.1.1.Develop a Plan of Action and Milestones for each information system to document the institution's planned remedial actions to correct weaknesses or deficiencies noted during the assessment of security controls relevant to an information system and to reduce or eliminate known vulnerabilities in the assessed system; and
6.1.2.Update existing plans of action and milestones at an institution-defined frequency based on the findings from controls assessments, audits, and continuous monitoring activities.
7.1.Component institutions must:
7.1.1.Assign a senior-level executive or manager as the Authorizing Official for each information system;
7.1.2.Assign a senior-level executive or manager as the Authorizing Official for common controls available for inheritance by institutional information systems;
7.1.3.Ensure that the Authorizing Official for an information system accepts the use of common controls inherited by the system and authorizes the information system for processing before commencing operations;
7.1.4.Ensure that the Authorizing Official for common controls authorizes the use of those controls for inheritance by institutional information systems; and
7.1.5.Update the security authorization at the time of periodic risk assessment for the information system or at an institution-defined frequency.
8.1.Component institutions must develop a continuous monitoring strategy and implement an information system-level continuous monitoring program that includes:
8.1.1.Establishment of system-level metrics to be monitored;
8.1.2.Establishment of frequencies for monitoring and for control assessments supporting such monitoring;
8.1.3.Ongoing control assessments in accordance with the institutional continuous monitoring strategy;
8.1.4.Ongoing monitoring of information system and institution-defined metrics in accordance with the institutional continuous monitoring strategy;
8.1.5.Correlation and analysis of security-related information generated by control assessments and monitoring;
8.1.6.Response actions to address results of the analysis of control assessment and monitoring information; and
8.1.7.Reporting the security status of each information system to appropriate stakeholders at an institutional-defined frequency.
8.2.Component institutions must ensure that risk monitoring is an integral part of the continuous monitoring strategy that includes the following:
8.2.1.Effectiveness monitoring;
8.2.2.Compliance monitoring; and
8.2.3.Change monitoring.
9.1.Each component institution must conduct penetration testing at an institution-defined frequency on institution-defined information systems and information system components.
9.2.Component institutions must ensure that:
9.2.1.Internet websites or mobile applications that process any sensitive personal information, personally identifiable information, or confidential information are subjected to a vulnerability and penetration test at an institution-defined frequency; and
9.2.2.Ensure that any vulnerability identified in each test is addressed in a fashion commensurate to the risks presented as determined by the institution’s ISO (or designee).
10.1.Each component institution must:
10.1.1.Authorize internal connections of institution-defined information system components or classes of components to each information system;
10.1.2.Document, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated;
10.1.3.Terminate internal system connections based on institution-defined conditions; and
10.1.4.Review the need for each internal connection at an institution-defined frequency.