Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around personnel security.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Personnel Security controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Personnel Security policy and associated controls;
3.1.2.Review and update Personnel Security procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Contingency Planning procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Assign a risk designation to all institutional positions;
4.1.2.Establish screening criteria for individuals filling those positions; and
4.1.3.Review and update position risk designations at an institution-defined frequency.
5.1.Component institutions must:
5.1.1.Screen individuals prior to authorizing access to information systems; and
5.1.2.Rescreen individuals when institution-defined conditions require rescreening and where rescreening is indicated, the frequency of rescreening.
6.1.Component institutions, upon termination of an individual’s employment or employment-like affiliation (e.g., volunteers, contractors, guest lecturers, temporary workers, interns), must:
6.1.1.Disable information system access and terminate/revoke any authenticators and credentials associated with the individual within an institution-defined time period;
6.1.2.Conduct exit interviews that include a discussion of institution-defined information security topics that include review of any signed non-disclosure agreements and secure disposition of university data from personal devices in a manner stipulated by the institution;
6.1.3.Retrieve all security-related, institutional information system-related property;
6.1.4.Retain access to institutional information and information systems formerly controlled by the terminated individual; and
6.1.5.Notify institution-defined personnel within an institution-defined time period.
6.2.Component institutions must establish procedures to sufficiently accommodate reasonably expected scenarios in which the controls in section 6.1 above cannot be fully executed upon the termination of an individual’s employment (e.g., the termination of an employee who is also an actively enrolled student). At minimum, procedures must ensure that access and privileges associated with the terminated individual’s employment or employment-like affiliation are removed even if the individual must retain access to information resources for other purposes.
7.1.Component institutions must:
7.1.1.Review and confirm ongoing operational need for current logical and physical access authorizations to information systems and facilities when individuals are reassigned or transferred to other positions within the institution;
7.1.2.Initiate transfer or reassignment actions within an institution-defined time period following the formal transfer action;
7.1.3.Modify access authorizations as needed to correspond with any changes in operational need because of reassignment or transfer; and
7.1.4.Notify institution-defined personnel or roles within an institution-defined time period.
8.1.Component institutions must:
8.1.1.Develop and document access agreements for institutional information systems;
8.1.2.Review and update the access agreements at an institution-defined frequency; and
8.1.3.Verify that individuals requiring access to institutional information and information systems:
8.1.3.1.Sign appropriate access agreements prior to being granted access; and
8.1.3.2.Re-sign access agreements to maintain access to institutional information systems when access agreements have been updated or at an institution-defined frequency.
9.1.Component institutions must:
9.1.1.Establish personnel security requirements including security roles and responsibilities for external providers;
9.1.2.Require external providers to comply with personnel security policies and procedures established by the institution;
9.1.3.Document personnel security requirements;
9.1.4.Require external providers to notify institution-defined personnel or roles of any personnel transfers or terminations of external personnel who possess institutional credentials and/or badges, or who have information system privileges within an institution-defined time period; and
9.1.5.Monitor provider compliance with personnel security requirements.
10.1.Component institutions must:
10.1.1.Employ a formal sanctions process for individuals failing to comply with established information security policies and procedures; and
10.1.2.Notify institution-defined personnel or roles within institution-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
11.1.Component institutions must incorporate security roles and responsibilities into institutional position descriptions.