Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around contingency planning.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At th e discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Contingency Planning implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Contingency Planning policy and associated controls;
3.1.2.Review and update Contingency Planning procedures at an institution-defined frequency;
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Contingency Planning procedures related to the controls in this policy; and
3.1.4.Maintain written continuity of operations plans that address information resources.
4.1.Component institutions must:
4.1.1.Develop a contingency plan for each information system that:
4.1.1.1.Identifies essential missions and business functions and associated contingency requirements;
4.1.1.2.Provides recovery objectives, restoration priorities, and metrics;
4.1.1.3.Addresses contingency roles, responsibilities, and assigned individuals with contact information;
4.1.1.4.Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;
4.1.1.5.Addresses eventual, full information system restoration without deterioration of the controls originally planned and implemented; and
4.1.1.6.Is reviewed and approved by institution-defined personnel or roles;
4.1.2.Distribute copies of the contingency plan to institution-defined key contingency personnel (identified by name and/or by role) and institutional elements;
4.1.3.Coordinate contingency planning activities with incident handling activities;
4.1.4.Review the contingency plan for each information system at an institution-defined frequency;
4.1.5.Update the contingency plan to address changes to the institution, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;
4.1.6.Communicate contingency plan changes to institution-defined key contingency personnel (identified by name and/or by role) and institutional elements; and
4.1.7.Protect the contingency plan from unauthorized disclosure and modification.
5.1.Component institutions must provide contingency training to information system users consistent with assigned roles and responsibilities:
5.1.1.Within an institution-defined time period of assuming a contingency role or responsibility;
5.1.2.When required by information system changes; and
5.1.3.On an institution-defined frequency thereafter.
6.1.Component institutions must:
6.1.1.Test the contingency plan for information systems at least annually using institution-defined tests to determine the effectiveness of the plan and the institutional readiness to execute the plan;
6.1.2.Review the contingency plan test results; and
6.1.3.Initiate corrective actions, if needed.
7.1.Component institutions must:
7.1.1.Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of information system backup information; and
7.1.2.Ensure that the alternate storage site provides controls equivalent to that of the primary site.
8.1.Component institutions must:
8.1.1.Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission and business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable; and
8.1.2.Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and
8.1.3.Provide controls at the alternate processing site that are equivalent to those at the primary site.
9.1.Component institutions must establish alternate telecommunications services, including necessary agreements to permit the resumption of institution-defined information system operations for essential mission and business functions within an institution-defined period of time when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.
10.1.Component institutions must:
10.1.1.Conduct backups of the following types of information at a frequency consistent with institution-defined recovery time and recovery point objectives:
10.1.1.1.User-level information contained in information systems;
10.1.1.2.System-level information contained in information systems; and
10.1.1.3.Information system documentation, including security-related documentation;
10.1.2.Protect the confidentiality, integrity, and availability of backup information.
10.1.3.Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.
10.1.4.Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire rated container that is not collocated with the operational system
11.1.Component institutions must have the capability for recovery and reconstitution of each information system to a known state after a disruption, compromise, or failure consistent with institution-defined recovery time and recovery point objectives.
12.1.Component institutions must have the capability to employ institution-defined alternative communications protocols in support of maintaining continuity of operations.