Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around media protection.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Media Protection controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Media Protection policy and associated controls;
3.1.2.Review and update Media Protection procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Media Protection procedures related to the controls in this policy.
4.1.Component institutions must restrict access to institution-defined types of digital and non-digital media to institution-defined personnel or roles.
5.1.Component institutions must:
5.1.1.Sanitize institution-defined system media prior to disposal, release out of institutional control, or release for reuse using institution-defined sanitization techniques and procedures; and
5.1.2.Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
5.2.Component institutions must review, approve, track, document, and verify media sanitization and disposal actions.
5.3.Component institutions must keep a record documenting the removal and completion of sanitization of media that stored confidential information with the following information:
5.3.1.Date;
5.3.2.Description of the item(s) and serial number(s);
5.3.3.Inventory number(s);
5.3.4.The process and sanitization tools used to remove the data or method of destruction; and
5.3.5.The name and address of the organization to which the media were transferred.
6.1.Component institutions must document and enforce a Standard defining at minimum:
6.1.1.The types of system media within scope of the Standard;
6.1.2.Whether and under what conditions, including on what information systems or information system components, the use of each type of system media is authorized, restricted, or prohibited; and
6.1.3.Controls required to use authorized types of system media.
6.2.The use of portable storage devices in institutional systems when such devices have no identifiable owner is prohibited.