Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around supply chain risk management.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Supply Chain Risk Management controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Supply Chain Risk Management policy and associated controls;
3.1.2.Review and update Supply Chain Risk Management procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Supply Chain Risk Management procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, and disposal of institution-defined information systems, system components or system services;
4.1.2.Implement the supply chain risk management plan consistently across the institution; and
4.1.3.Review and update the supply chain risk management plan at an institution-defined frequency or as required, to address threat, organizational or environmental changes.
5.1.Component institutions must:
5.1.1.Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of institution-defined information systems or information system components in coordination with institution-defined personnel or roles;
5.1.2.Employ institution-defined supply chain controls to protect against supply chain risks to information systems, information system components, or information system services and to limit the harm or consequences from supply chain-related events; and
5.1.3.Document the selected and implemented supply chain processes and controls in security plans, supply chain risk management plan(s), and/or institution-defined documents.
6.1.Component institutions must:
6.1.1.Employ institution-defined acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.
7.1.Component institutions must:
7.1.1.Establish agreements and procedures with entities involved in the supply chain for information systems, information system components, or information system services for the one or more of the following:
7.1.1.1.Notification of supply chain compromises;
7.1.1.2.Results of assessments or audits; and/or
7.1.1.3.Institution-defined information and controls.
8.1.Component institutions must:
8.1.1.Dispose of institution-defined data, documentation, tools, and/or information system components using institution-defined techniques and methods.