Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around configuration management.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Configuration Management implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Configuration Management policy and associated controls;
3.1.2.Review and update Configuration Management procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Configuration Management procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Develop, document, and maintain under configuration control, a current baseline configuration of each information system; and
4.1.2.Review and update the baseline configuration of each information system:
4.1.2.1.At an institution-defined frequency;
4.1.2.2.When required because of institution-defined circumstances; and
4.1.2.3.When information system components are installed or upgraded.
5.1.Component institutions must:
5.1.1.Determine and document the types of changes to information systems that are configuration-controlled;
5.1.2.Review proposed configuration-controlled changes to information systems and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
5.1.3.Document configuration change decisions associated with the information systems;
5.1.4.Implement approved configuration-controlled changes to the information systems;
5.1.5.Retain records of configuration-controlled changes to information systems for an institution-defined period of time;
5.1.6.Monitor and review activities associated with configuration-controlled changes to information systems; and
5.1.7.Coordinate and provide oversight for configuration change control activities through institution-defined configuration change control elements that convenes at an institution-defined frequency and/or when institution-denied configuration change conditions are met.
5.2.Component institutions must ensure that all security-related information resources changes are approved by the information owner (or designee) through a change control process.
6.1.Component institutions must analyze changes to each information system to determine potential security impacts prior to change implementation.
7.1.Component institutions must define, document, approve, and enforce physical and logical access restrictions associated with changes to each information system.
8.1.Component institutions must:
8.1.1.Establish and document configuration settings for components employed within information systems using institution-defined, common security configurations that reflect the most restrictive mode consistent with operational requirements;
8.1.2.Implement the configuration settings;
8.1.3.Identify, document, and approve any deviations from established configuration settings for institution-defined information system components based on institution-defined operational requirements; and
8.1.4.Monitor and control changes to the configuration settings in accordance with institutional policies and procedures.
9.1.Component institutions must:
9.1.1.Configure each information system to provide only institution-defined, mission-essential capabilities; and
9.1.2.Prohibit or restrict the use of institution-defined functions, ports, protocols, software and/or services.
10.1.Component institutions must:
10.1.1.Develop and document an inventory of information system components that:
10.1.1.1.Accurately reflects the information system;
10.1.1.2.Includes all components within each information system;
10.1.1.3.Is at the level of granularity deemed necessary for tracking and reporting;
10.1.1.4.Includes institution-defined information deemed necessary to achieve effective information system component accountability; and
10.1.2.Review and update the information system component inventory at an institution-defined frequency.
11.1.Component institutions must:
11.1.1.Use software and associated documentation in accordance with contract agreements and copyright laws;
11.1.2.Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
11.1.3.Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
12.1.Component institutions must:
12.1.1.Establish institution-defined policies governing the installation of software by users;
12.1.2.Enforce software installation policies through institution-defined methods; and
12.1.3.Monitor policy compliance at institution-defined frequency.