Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around awareness and training.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Training implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Awareness and Training policy and associated controls;
3.1.2.Review and update Awareness and Training procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Awareness and Training procedures related to the controls in this policy; and
3.1.4.Provide information security training for all users of institutional information systems in accordance with applicable state and federal law, including, but not limited to, Texas Government Code § 2054.519, §2054.5191, and §2054.5192;
4.1.Component institutions must:
4.1.1.Provide security literacy training to:
4.1.1.1.Employees at least annually or as required by changes to information systems;
4.1.1.2.New employees during the onboarding process; and
4.1.1.3.Contractors who have access to a component institution’s computer system or database.
4.1.2.Update security awareness and literacy training at an institution-defined frequency; and
4.1.3.Provide literacy training on recognizing and reporting potential indicators of insider threat.
5.1.Component institutions must:
5.1.1.Provide role-based security training:
5.1.1.1.To information resource employees with administrative privileges and responsibilities;
5.1.1.2.Before authorizing access to information systems, information, or performing assigned duties;
5.1.1.3.To information resource employees on a recurring basis (at least annually) and when required by system changes.
5.1.2.Update role-based training content at an institution-defined frequency.
6.1.Component institutions must:
6.1.1.Document and monitor information security training activities, including security awareness training and specific role-based security training; and
6.1.2.Retain individual training records for an institution-defined time period.