Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around audit and accountability.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Audit and Accountability controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Audit and Accountability policy and associated controls;
3.1.2.Review and update Audit and Accountability procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Audit and Accountability procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Document a standard defining the types of events that each information system shall log, including the frequency at which the types of events selected for logging are reviewed and updated;
4.1.2.Identify, for each information system, the types of events that the system is capable of logging in support of the audit function as specified in the component institution’s Standard;
4.1.3.Require information owners and information custodians to coordinate with each component institution’s ISO (or their designee) to coordinate event logging functions;
4.1.4.Specify the types of events from its standard that are configured for logging within each information system along with the frequency of (or situation requiring) logging for each identified type of event;
4.1.5.Provide a rationale for why institution-defined auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and
4.1.6.Review and update event types selected for logging according to the Standard for each information system.
4.2.Component institutions must:
4.2.1.Ensure information systems provide the means whereby authorized personnel have the ability to audit and establish individual accountability for each action that can potentially cause access to, generation or modification of, or affect the release of confidential information;
4.2.2.Ensure appropriate audit trails are maintained to provide accountability for updates to mission-critical information, hardware and software, and for all changes to automated security or access rules; and
4.2.3.Based upon an assessment of risk, maintain a sufficiently complete history of transactions to permit an audit of the information system by logging and tracing the activities of individuals through each information system.
5.1.Component institutions must ensure that each information system’s audit records contain the following information:
5.1.1.What type of event occurred;
5.1.2.When the event occurred;
5.1.3.Where the event occurred;
5.1.4.Source of the event;
5.1.5.Outcome of the event; and
5.1.6.Identity of any individuals, subjects, or objects/entities associated with the event.
6.1.Component institutions must:
6.1.1.Allocate audit-log storage capacity to accommodate institution-defined audit log retention requirements.
7.1.Component institution must:
7.1.1.Document in a standard the audit processing failures that generate alerts, the appropriate personnel or roles to alert, the time period in which to be alerted, and any additional actions to take;
7.1.2.In accordance with the standard, configure information systems to send designated alerts to appropriate personnel or roles in the event of applicable audit processing failures; and
7.1.3.Take any additional actions in accordance with the standard in the event of an audit logging process failure of an information system.
8.1.Component institutions must:
8.1.1.Document in a standard the frequency at which information system audit records are reviewed and analyzed;
8.1.2.Review and analyze information system audit records in accordance with the frequency specified in the standard and report actionable findings to the appropriate information system custodians; and
8.1.3.Adjust the level of audit record review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
9.1.Component institutions must:
9.1.1.Configure each information system to:
9.1.1.1.Use internal system clocks to generate time stamps for audit records; and
9.1.1.2.Synchronize internal system clocks with an authoritative source of time specified by the component institution;
9.1.2.Ensure that audit records record time stamps in milliseconds and:
9.1.2.1.Use Coordinated Universal Time;
9.1.2.2.Have a fixed local time offset from Coordinated Universal Time; or
9.1.2.3.Include the local time offset as part of the timestamp.
10.1.Component institutions must protect audit information and audit tools from unauthorized access, modification, and deletion.
11.1.Component institutions must:
11.1.1.Ensure records retention policies for audit records meets regulatory and institutional information retention requirements; and
11.1.2.Retain audit records for a period no less than is required by its records retention policy to provide sufficient support for after-the-fact investigations of security incidents.
12.1.Component institutions must ensure that information systems:
12.1.1.Provide audit record generation capability for the auditable events required by this policy and related institutional policies and standards;
12.1.2.Allow authorized personnel or roles to select which auditable events are to be audited by specific components of the information system; and
12.1.3.In alignment with this policy and related institutional policies and standards, generate audit records for necessary types of events and ensure the generated records contain sufficient content.