Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around incident response.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Incident Response controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Incident Response policy and associated controls; and
3.1.2.Review and update Incident Response procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Incident Response procedures related to the controls in this policy.
3.2.Each component institution must assess the significance of a security incident based upon the business impact on the affected resources and the current and potential technical effect of the incident.
4.1.Component institutions must provide incident response training to information system users consistent with their assigned roles and responsibilities:
4.1.1.Within an institution-defined time period of assuming an incident response role or responsibility or acquiring information system access;
4.1.2.When required by information system changes; and
4.1.3.At an annual frequency thereafter.
5.1.Component institutions must test the effectiveness of the incident response capability for each information system at an institution-defined frequency using the institution-defined tests for each information system.
6.1.Component institutions must:
6.1.1.Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery
6.1.2.Coordinate incident handling activities with contingency planning activities;
6.1.3.Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
6.1.4.Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the institution.
7.1.Component institutions must track and document security and supply chain incidents.
8.1.Component institutions must:
8.1.1.Require personnel to report suspected security and supply chain incidents to the component institution’s ISO (or their designee) using institution-defined procedures within an institution-defined time period;
8.1.2.Develop policies and mechanisms providing for notification to the ISO (or their designee) of any Suspected Data Breach within 48 hours of discovery;
8.1.3.Promptly report security and supply chain incidents to the Department of Information Resources (DIR) when the security incident is assessed to:
8.1.3.1.Propagate to other state information systems;
8.1.3.2.Result in criminal violations that shall be reported to law enforcement in accordance with state or federal information security or privacy laws;
8.1.3.3.Involve the unauthorized disclosure or modification of confidential information; or
8.1.3.4.be an unauthorized incident that compromises, destroys, or alters information systems, applications, or access to such systems or applications in any way.
8.1.4.Report summary security and supply chain incident information monthly to DIR no later than 9 calendar days after the end of the month.
8.2.If an information security or supply chain incident is required to be reported to the DIR under Texas Government Code Sec. 2054.1125 or the “Urgent Incident Report” rules per Texas Administrative Code 202.73(b), the component institution’s established reporting and escalation procedures shall also require notification to the Texas State University System Administration via the Vice Chancellor and Chief Financial Officer and the Chief Audit Executive in a similar reporting manner and timeline.
9.1.Component institutions must provide an incident response resource, integral to the component institution’s incident response capability, that advises and assists users of information systems in handling and reporting security and supply chain incidents. The incident response resource must be determined by each component institution’s ISO and may be comprised of technical support personnel, verified third-party consultants, and other resources.
10.1.Component institutions must:
10.1.1.Develop an incident response plan that:
10.1.1.1.Provides the institution with a roadmap for implementing its incident response capability;
10.1.1.2.Describes the structure and organization of the incident response capability;
10.1.1.3.Provides a high-level approach for how the incident response capability fits in to the overall institution;
10.1.1.4.Meets the unique requirements of the institution, which relate to mission, size, structure, and functions;
10.1.1.5.Defines reportable incidents;
10.1.1.6.Provides metrics for measuring the incident response capability within the institution;
10.1.1.7.Defines the resources and management support needed to effectively maintain and mature an incident response capability; and
10.1.1.8.Is reviewed and approved by appropriate, institution-defined leadership; and
10.1.1.9.Explicitly designates responsibility for incident response to institution-defined roles.
10.1.2.Distribute copies of the incident response plan to institutional elements charged with incident response responsibilities defined by name and/or role;
10.1.3.Update the incident response plan to address system and institutional changes or problems encountered during plan implementation, execution, or testing;
10.1.4.Communicate changes to the incident response plan to institutional elements charged with incident response responsibilities defined by name and/or role; and
10.1.5.Protect the incident response plan from unauthorized disclosure and modification.
11.1.Component institutions must respond to information spills by:
11.1.1.Assigning, in the incident response plan, personnel or roles with responsibility for responding to information spills;
11.1.2.Identifying the specific information involved in the information system contamination;
11.1.3.Alerting personnel identified in the incident response plan of the information spill using a method of communication not associated with the spill;
11.1.4.Isolating the contaminated information system or information system component;
11.1.5.Eradicating the information from the contaminated information system or component;
11.1.6.Identifying other information systems or information system components that may have been subsequently contaminated; and
11.1.7.Performing any additional actions defined in the incident response plan.