Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around program management.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Program management controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop and disseminate an institution-wide information security program plan that:
3.1.1.1.Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
3.1.1.2.Includes the identification and assignment of roles, responsibilities, management commitment, coordination among institutional entities, and compliance;
3.1.1.3.Reflects the coordination among institutional entities responsible for information security; and
3.1.1.4.Is approved by a senior official with responsibility and accountability for the risk being incurred to institutional operations (including missions, functions, image, and reputation), institutional assets, and individuals;
3.1.2.Review the institution-wide information security program plan at an institution-defined frequency;
3.1.3.Update the information security program plan to address institutional changes and problems identified during plan implementation or control assessments; and
3.1.4.Protect the information security program plan from unauthorized disclosure and modification.
4.1.Component institutions must:
4.1.1.Each component institution must appoint a senior information security officer with the mission and resources to coordinate, develop, implement, and maintain an institution-wide information security program approved by the institution of higher education head or delegate.
4.1.2.Each component institution’s senior information security officer is charged with the responsibilities enumerated at Texas Government Code §2054.136 and 1 Texas Administrative Code §202.71.
5.1.Component institutions must:
5.1.1.Include the resources needed to implement the information security program in capital planning and investment requests and document all exceptions to this requirement;
5.1.2.Prepare documentation required for addressing the information security program in capital planning and investment requests in accordance with applicable laws, regulations, policies and standards; and
5.1.3.Make available for expenditure, the planned information security resources.
6.1.Component institutions must:
6.1.1.Implement a process to ensure that plans of action and milestones for the information security program and associated institutional information systems:
6.1.1.1.Are developed and maintained;
6.1.1.2.Document the remedial information security actions to adequately respond to risk to institutional operations and assets, individuals, and other organizations; and
6.1.1.3.Are reported in accordance with institution-defined reporting requirements.
6.1.2.Review plans of action and milestones for consistency with the institutional risk management strategy and institution-wide priorities for risk response actions.
7.1.Component institutions must:
7.1.1. develop and update, on an institution-defined frequency, an inventory of institutional information systems.
7.1.2.Establish, maintain, and update on an organization-defined frequency an inventory of all systems, applications, and projects that process personally identifiable information.
8.1.Component institutions must develop, monitor, and report to institution-defined individuals on the results of information security measures of performance.
9.1.Component institutions must develop an enterprise architecture with consideration for information security and the resulting risk to institutional operations, institutional assets, individuals, and other organizations.
10.1.Component institutions must:
10.1.1.Develop a comprehensive strategy to manage:
10.1.1.1.Security risk to institutional operations and assets, individuals, and other institutional information systems; and
10.1.1.2.Privacy risk to individuals resulting from the authorized processing of personally identifiable information.
10.1.2.Implement the risk management strategy consistently across the institution; and
10.1.3.Review and update the risk management strategy on an institution-defined frequency or as required to address institutional changes.
11.1.Component institutions must:
11.1.1.Manage the security of institutional information systems and the environments in which those systems operate through authorization processes;
11.1.2.Designate individuals to fulfill specific roles and responsibilities within the institutional risk management process; and
11.1.3.Integrate the authorization process into an institution-wide risk management program.
12.1.Component institutions must:
12.1.1.Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations; and
12.1.2.Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
12.1.3.Review and revise the mission and business processes on an organization-defined frequency.
13.1.Component institutions must:
13.1.1.Implement a process for ensuring that institutional plans for conducting security testing, training, and monitoring activities associated with institutional information systems:
13.1.1.1.Are developed and maintained; and
13.1.1.2.Continue to be executed; and
13.1.2.Review testing, training, and monitoring plans for consistency with the institutional risk management strategy and institution-wide priorities for risk response actions.
14.1.Component institutions must establish and institutionalize contact with selected groups and associations within the information security community:
14.1.1.To facilitate ongoing information security education and training for institutional information security personnel;
14.1.2.To maintain currency with recommended information security practices, techniques, and technologies; and
14.1.3.To share current information security information, including threats, vulnerabilities, and incidents.
15.1.Component institutions must implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
16.1.Component institutions must:
16.1.1.Review the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
16.1.2.Correct or delete inaccurate or outdated personally identifiable information;
16.1.3.Disseminate notices of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
16.1.4.Appeals of adverse decisions on correction or deletion requests
17.1.Component institutions must define a management framework which clearly delineates the roles and responsibilities for the management of institutional information systems.
17.2.At minimum, each component institution’s information system management framework must:
17.2.1.Delineate distinct roles for the information owner and information custodian of each information system;
17.2.2.Establish the responsibilities of information owners to include:
17.2.2.1.Duties ascribed by TAC §477.72; and
17.2.2.2.Assurance of compliance with state and institutional standards.
17.2.3.Establish the responsibilities of information custodians to include:
17.2.3.1.Duties ascribed by TAC §477.72; and
17.2.3.2.Assurance of compliance with state and institutional standards.
17.2.4.Establish the responsibilities of all information system users to, at minimum, require users to:
17.2.4.1.Use the information system or other information resource only for the purpose specified by the institution or information owner;
17.2.4.2.Comply with information security controls and institutional policies, including those designed to prevent unauthorized or accidental disclosure, modification, or destruction of information and information resources; and
17.2.4.3.Formally acknowledge that they will comply with the security policies and procedures in a method determined by the institution's head or their designated representative.
17.2.5.Incorporate threat and incident response procedures as specified in the TSUS Incident Response Policy.
17.2.6.Incorporate oversight measures including, but not limited to, obligations outlined in the TSUS “System and Services Acquisition” and “Risk Assessment” policies.
18.1.Component institutions must define a management framework which clearly delineates the roles and responsibilities for the management of institutional information networks.
18.2.At minimum, each component institution’s network management framework must:
18.2.1.Delineate distinct roles for the ownership and custodianship of the institution’s network;
18.2.2.Assign administration of the institutional network by the Information Resources Manager (IRM) or their designee;
18.2.3.Ensure owners, custodians, and users of the institutional network and the devices and information systems connected to the institutional network understand their accountability for such use, including, but not limited to, the Rules of Behavior as specified in the “Planning” TSUS IT Policy.
18.2.4.Incorporate design and architectural planning and coordination measures to, at minimum, include the following:
18.2.4.1.Appropriate logical and/or physical segmentation of elements of the institutional network to promote sufficient separation of traffic based on security principles and performance purposes as authorized by each component institution’s ISO.
18.2.4.2.Fault tolerance in critical components of the network and upstream service providers to mitigate risks to network availability;
18.2.4.3.Institution-defined procedures for the management of network-based security devices;
18.2.4.4.Procedures for the management of public IP addresses assigned to the component institution by the American Registry for Internet Numbers (ARIN) and/or other external entities, including, at minimum, maintenance of up-to-date points of contact;
18.2.4.5.Institution-defined procedures to ensure network devices or addresses that pose an immediate threat to network operations, performance, or other network-connected devices are disconnected or quarantined to minimize risk until the threat is permanently removed;
18.2.4.6.Institution-defined procedures to ensure incident response actions comply with established, policy-defined controls and best practices regarding the preservation and treatment of forensic data;
18.2.4.7.Adherence to the requirements set forth in the “Configuration Management” TSUS IT Policy;
18.2.4.8.Implementation of safeguards as required by the “System and Communication Protection” TSUS IT Policy; and
18.2.4.9.Procedures to regularly conduct security and risk assessments in alignment with relevant policies and laws, including the “Risk Assessment” TSUS IT Policy.