Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around security planning.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Security planning procedures implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Security Planning policy and associated controls;
3.1.2.Review and update Security Planning procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Security Planning procedures related to the controls in this policy.
3.2.Each component institution’s information security officer must report annually on the institution’s information security program to their respective institution head in compliance with 1 Texas Administrative Code §477.73(a).
4.1.Component institutions must ensure that each information system under the institution’s custodianship has a corresponding System Security Plan that:
4.1.1.Is consistent with the institution's enterprise architecture;
4.1.2.Explicitly defines the constituent information system component(s);
4.1.3.Describes the function and security posture of the information system, including in terms of mission and business processes;
4.1.4.Provides the security categorization of the information system and highest classification of information it stores, processes, and/or transmits, including supporting rationale;
4.1.5.Describes any specific threats to the information system that are of concern to the institution;
4.1.6.Describes the operational environment for the information system and relationships with or connections to other information systems;
4.1.7.Provides an overview of the security requirements for the information system that identifies the security controls in place;
4.1.8.Identifies any relevant security control baselines and, if applicable, institution-defined overlays;
4.1.9.Describes the controls in place or planned for meeting the security requirements, including a rationale for any tailoring decisions;
4.1.10.Includes risk determinations for security architecture and design decisions;
4.1.11.Includes in a plan of action and milestones security-related activities affecting the information system that require planning and coordination with institution-defined individuals or groups; and
4.1.12.Is reviewed and approved by the information owner prior to plan implementation.
4.2.Copies of the System Security Plan and subsequent changes to the plan must be distributed to relevant stakeholders.
4.3.Component institutions must review and update System Security Plans on a recurring basis. This review must occur at an institution-defined frequency or when changes to the information system or System Security Plan require it.
4.4.System Security Plans must be protected from unauthorized disclosure and modification.
5.1.Component institutions must:
5.1.1.Establish and provide to users (including, but not limited to, state agency personnel, temporary employees, and employees of independent contractors) an acceptable use policy for institutional information resources that describes the users’ responsibilities and expected behavior for the usage and security of information and Information Resources;
5.1.2.Periodically review and update the institutional acceptable use policy;
5.1.3.Require institutional users to acknowledge the acceptable use policy and indicate that the users have read, understand, and agree to abide by the acceptable use policy before authorizing access to the information and Information Resources; and
5.1.4.Require individuals who have acknowledged a previous version of the acceptable use policy to read and re-acknowledge when rules are revised or updated or at least annually as part of mandatory cybersecurity training.
5.2.Component institutions must include in the rules of behavior restrictions on:
5.2.1.Use of social media, social networking sites, and external sites/applications;
5.2.2.Posting institutional information on public websites; and
5.2.3.Use of institution-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
6.1.Component institutions must:
6.1.1.Select a control baseline for information systems; and
6.1.2.Use the controls contained in the DIR Security Controls Standards Catalog as the default baseline for information systems.
7.1.Component institutions must tailor the selected control baseline by applying institution-defined tailoring actions.
8.1.On initiation of an information resources technology project, including an application development project and any information resources projects described in subchapter G of Texas Government Code §2054, each component institution shall classify the data produced from or used in the project and determine appropriate data security and applicable retention requirements under Texas Government Code §441.185 for each classification.
9.1.Each component institution’s rules of behavior must address, at minimum, the rules established in this section.
9.2.Institutional vs. Individual Purpose
9.2.1.Users accessing institutional information resources are responsible for ensuring that their use of these resources is primarily for institutional purposes and institution-related activities.
9.2.2.Access to information resources carries with it the responsibility for maintaining the security of the institution’s information resources.
9.2.3.Rules for incidental use of institutional information resources.
9.2.4.Individuals with authorized access to information resources must ensure that their access permissions are not accessible to or usable by any other individuals.
9.3.Personal vs. Official Representation
9.3.1.Students, faculty, and staff using information resources to reflect the ideas, comments, and opinions of individual members of the institutional community must be distinguished from those that represent the official positions, programs, and activities of the institution.
9.3.2.Students, faculty, and staff using information resources for purposes of exchanging, publishing, or circulating official institutional documents must follow institutional requirements concerning appropriate content and style.
9.3.3.The institution is not responsible for the personal ideas, comments, and opinions of individual members of the institutional community expressed through the use of institutional information resources.
9.4.Limitations on the Availability of Information Resources
9.4.1.The institution’s information resources are finite by nature. All members of the institutional community must recognize that certain uses of institutional information resources may be limited or regulated as required to fulfill the institution’s primary teaching, research, and public service missions. Examples of these limitations include those related to capacity management, performance optimization, or security of the institution’s other information resources.
9.5.Privacy and Confidentiality of Electronic Documents
9.5.1.No information system can absolutely guarantee the privacy or confidentiality of electronic documents.
9.5.2.Information resources provided by the TSUS and its component institutions are essentially owned, respective of established copyright and intellectual law and TSUS and institutional policy, by the State of Texas and subject to state oversight. Consequently, persons have no right to privacy in their use of institutional information resources even when using a personal or third-party device to access such resources.
9.5.3.TSUS institutions should take reasonable precautions to protect the privacy and confidentiality of electronic documents and to assure persons using institutional information resources that the institution will not seek access to their electronic messages or documents without their prior consent except where necessary to:
9.5.3.1.Satisfy the requirements of the Texas Public Information Act, or other statutes, laws, or regulations;
9.5.3.2.Allow institutional officials to fulfill their responsibilities when acting in their assigned capacity;
9.5.3.3.Protect the integrity of the institution’s information resources, and the rights and other property of the institution;
9.5.3.4.Allow system administrators to perform routine maintenance and operations, security reviews, and respond to emergency situations; or
9.5.3.5.Protect the rights of individuals working in collaborative situations where information and files are shared.
9.5.4.TSUS institutions should establish procedures for appropriately preserving the privacy of information resources and for determining the methodology by which non-consensual access to information resources will be pursued by the institution.
9.6.Failure to Comply with Information Technology Policies
9.6.1.Failure to adhere to the provisions of TSUS IT policies or the IT policies of any component institution may result in:
9.6.1.1.Suspension or loss of access to institutional information resources;
9.6.1.2.Removal of elevated privileges to institutional information resources;
9.6.1.3.Appropriate disciplinary action under existing procedures applicable to institutional users; and
9.6.1.4.Civil or criminal prosecution.
9.6.2.To preserve and protect the integrity of information resources, there may be circumstances where the institution must immediately suspend or deny access to the resources. Should an individual’s access be suspended under these circumstances, the institution shall strive to inform the individual in a timely manner and afford the individual an opportunity to respond. The institution shall then determine what disciplinary action is warranted and shall follow the procedures established for such cases.