Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around risk assessment.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Risk Assessment controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Risk Assessment policy and associated controls;
3.1.2.Review and update Risk Assessment procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Risk Assessment procedures related to the controls in this policy.
4.1.Each component institution’s ISO must establish requirements for security categorization of information systems.
4.2.Component institutions must:
4.2.1.Categorize information systems, at a minimum of “high,” “moderate,” or “low,” and in accordance with applicable laws, regulations and policies;
4.2.2.Identify and define institution-appropriate information classification categories including, at minimum, the definition of “Confidential Information” as specified by 1 Texas Administrative Code Chapter 202, Subchapter A;
4.2.3.Document the security categorization results, including supporting rationale, in the system security plan for each information system; and
4.2.4.Verify that security categorization decisions are reviewed and approved by the authorizing official or the authorizing official’s designated representative.
5.1.Component institutions must:
5.1.1.Conduct an assessment of risk, including:
5.1.1.1.The likelihood and magnitude of harm from the unauthorized access, use, disclosure, disruption, modification, or destruction of each information system and the information processed, stored, and/or transmitted, and any related information;
5.1.1.2.The likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; and
5.1.1.3.The identification of threats to and vulnerabilities in each information system;
5.1.2.Integrate risk assessment results and risk management decisions from the institution and mission or business process perspectives with information system-level risk assessments;
5.1.3.Review and document risk assessment results in a report on a recurring, institution-defined frequency;
5.1.4.Disseminate risk assessment results to institution-defined personnel or roles;
5.1.5.Update the risk assessment at an institution-defined frequency or when there are significant changes to information systems, environments of operation, or other conditions that may impact the security state of information systems; and
5.1.6.Ensure risk assessments are performed by information owners and supported by information custodians:
5.1.6.1.At least biennially for systems containing confidential data;
5.1.6.2.Periodically, at a frequency determined by the institution, for systems containing non-confidential data; and
5.1.6.3.When significant changes to the information system or environment of operation, or other conditions that may impact the security state of the system occur.
5.2.Component institutions must:
5.2.1.Assess supply chain risks associated with institution-defined systems, system components, and system services; and
5.2.2.Update the supply chain risk assessment at an institution-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environment of operation, or other conditions may necessitate a change in the supply chain.
5.3.Authorization of security risk acceptance, transference, or mitigation decisions shall be the responsibility of:
5.3.1.The component institution’s ISO or their designee(s), in coordination with the information owner, for systems identified with low or moderate residual risk; or
5.3.2.The component institution’s President for all systems identified with a high residual risk.
6.1.Component Institutions must:
6.1.1.Monitor and scan for vulnerabilities in each information system and its hosted applications on a recurring frequency, at least annually, in accordance with each component institution’s established process and when new vulnerabilities potentially affecting systems or applications are identified and reported;
6.1.2.Employ vulnerability monitoring and scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using institution-defined standards for:
6.1.2.1.Enumerating platforms, software flaws, and improper configurations;
6.1.2.2.Formatting checklists and test procedures; and
6.1.2.3.Measuring vulnerability impact;
6.1.3.Analyze vulnerability scan reports from vulnerability monitoring activities and results from security assessments;
6.1.4.Remediate legitimate vulnerabilities in an institution-defined response time in accordance with an institutional assessment of risk;
6.1.5.Share information obtained from the vulnerability scanning and monitoring processes and security assessments with appropriate information system custodians in accordance with each component institution’s internal dissemination procedures; and
6.1.6.Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
6.2.Component institutions must update the information system vulnerabilities to be scanned when at least one of the following conditions are met:
6.2.1.At an institution-defined frequency;
6.2.2.Prior to a new scan; and/or
6.2.3.When new vulnerabilities are identified and reported.
7.1.Component institutions must establish a public reporting channel for receiving reports of vulnerabilities in institutional information systems and information system components.
8.1.Component Institutions must respond to findings from security assessments, monitoring, and audits in accordance with institutional risk tolerance.