Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around physical and environmental protection.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Physical and Environmental Protection controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
1.2.Physical and environmental protection controls found in this policy apply to facilities under the custodianship of component institutions that house information systems.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Physical and Environmental Protection policy and associated controls;
3.1.2.Review and update Physical and Environmental Protection procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Physical and Environmental Protection procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Develop, approve, and maintain a list of individuals with authorized access to facilities in which one or more institutional information systems reside;
4.1.2.Issue authorization credentials for facility access;
4.1.3.Review the access list detailing authorized facility access by individuals at an institution-defined frequency; and
4.1.4.Remove individuals from the facility access list when access is no longer required.
5.1.Component institutions must:
5.1.1.Enforce physical access authorizations at institution-defined entry and exit points to facilities in which one or more institutional information systems reside by:
5.1.1.1.Verifying individual access authorizations before granting access to each facility; and
5.1.1.2.Controlling ingress and egress to each facility using institution-defined physical access control systems, which may include systems, devices, and/or guards;
5.1.2.Maintain physical access audit logs for institution-defined entry and exit points;
5.1.3.Control access to areas within each facility designated as publicly accessible using institution-defined controls;
5.1.4.Escort visitors and monitor visitor activity based on institution-defined requirements;
5.1.5.Secure keys, combinations, and other physical access devices;
5.1.6.Inventory institution-defined physical access devices at an institution-defined frequency; and
5.1.7.Change combinations and keys:
5.1.7.1.At an institution-defined frequency; and/or
5.1.7.2.When keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
6.1.Component institutions must:
6.1.1.Monitor physical access to facilities in which one or more institutional information systems reside to detect and respond to physical security incidents;
6.1.2.Review physical access logs at an institution-defined frequency and upon occurrence of institution-defined events or potential indications of events; and
6.1.3.Coordinate results of reviews and investigations with the institutional incident response capability.
7.1.Component institutions must:
7.1.1.Maintain visitor access records to facilities in which one or more institutional information systems reside for an institution-defined period;
7.1.2.Review visitor access records at an institution-defined frequency; and
7.1.3.Report anomalies in visitor access records to institution-defined personnel.
8.1.Component institutions must employ and maintain automatic emergency lighting that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within facilities in which one or more institutional information systems reside.
9.1.Component institutions must employ and maintain fire suppression and detection devices or systems for facilities in which one or more institutional information systems reside that are supported by an independent energy source.
10.1.Component institutions must:
10.1.1.Maintain temperature and humidity levels within facilities in which one or more institutional information systems reside at institution-defined acceptable levels; and
10.1.2.Monitor environmental control levels at an institution-defined frequency.
11.1.Component institutions must protect facilities in which one or more institutional information systems reside from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
12.1.Component institutions must:
12.1.1.Authorize and control institution-defined types of information system components entering and exiting facilities in which one or more institutional information systems reside; and
12.1.2.Maintain records of institution-defined information system components.
13.1.Component institutions must:
13.1.1.Determine and document institution-defined alternate work sites allowed for use by employees;
13.1.2.Employ institution-defined controls at alternate work sites;
13.1.3.Assess the effectiveness of controls at alternate work sites; and
13.1.4.Provide a means for employees to communicate with information security personnel in case of incidents.