Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls regarding maintenance.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Maintenance controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Maintenance policy and associated controls;
3.1.2.Review and update Maintenance procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Maintenance procedures related to the controls in this policy.
4.1.Component institutions must require information custodians to:
4.1.1.Schedule, document, and review records of maintenance, repair, and/or replacement on information system components in accordance with manufacturer or vendor specifications and/or institution-defined requirements;
4.1.2.Approve and monitor all maintenance activities, whether performed on site or remotely and whether the information system or information system components are serviced on site or removed to another location;
4.1.3.Explicitly approve the removal of the information system or information system components from institutional facilities for off-site maintenance, repair, and/or replacement;
4.1.4.Sanitize equipment to remove all information from associated media prior to removal from institutional facilities for off-site maintenance, repair, and/or replacement;
4.1.5.Check all potentially impacted security controls to verify that the controls are still functioning properly following maintenance, repair, and/or replacement actions; and
4.1.6.Update appropriate institutional maintenance records following maintenance, repair, and/or replacement actions.
5.1.Component institutions, directly or contractually, must:
5.1.1.Approve and monitor nonlocal maintenance and diagnostic activities;
5.1.2.Allow the use of nonlocal maintenance and diagnostic tools only as consistent with institutional policy and documented in the security plan for the information system;
5.1.3.Employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;
5.1.4.Maintain records for nonlocal maintenance and diagnostic activities; and
5.1.5.Terminate session and network connections when nonlocal maintenance is completed.
6.1.Component institutions must:
6.1.1.Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
6.1.2.Verify that non-escorted personnel performing maintenance on information systems possess the required access authorizations; and
6.1.3.Designate institutional personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.