Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around system and information integrity.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.System and information controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the System and Information Integrity policy and associated controls;
3.1.2.Review and update System and Information Integrity procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional System and Information Integrity procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Identify, report to institutional personnel or roles with information security responsibilities, and correct information system flaws;
4.1.2.Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;
4.1.3.Install security-relevant software and firmware updates within an institution-defined time period of the release of the updates; and
4.1.4.Incorporate flaw remediation into the institutional configuration management process.
5.1.Component institutions must:
5.1.1.Implement, signature-based and/or non-signature based malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;
5.1.2.Automatically update malicious code protection mechanisms as new releases are available in accordance with institutional configuration management policy and procedures;
5.1.3.Configure malicious code protection mechanisms to:
5.1.3.1.Perform periodic scans of information systems at an institution-defined frequency and real-time scans of files from external sources at endpoints and/or network entry/exit points as the files are downloaded, opened, or executed in accordance with institutional security policy; and
5.1.3.2.Perform one or more of the following in response to malicious code detection: block malicious code; quarantine malicious code; send an alert to institution-defined personnel or roles; and/or perform another institution-defined action.
5.1.4.Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of information systems.
6.1.Component institutions must:
6.1.1.Monitor each information system to detect:
6.1.1.1.Attacks and indicators of potential attacks in accordance with institution-defined monitoring objectives; and
6.1.1.2.Unauthorized local, network, and remote connections;
6.1.2.Identify unauthorized use of information systems through institution-defined techniques and methods;
6.1.3.Deploy monitoring devices and/or invoke internal monitoring capabilities:
6.1.3.1.Strategically within information systems to collect institution-defined essential information; and
6.1.3.2.At ad hoc locations within information systems to track specific types of transactions of interest to the institution;
6.1.4.Analyze detected events and anomalies;
6.1.5.Protect information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;
6.1.6.Adjust the level of information system monitoring activity whenever there is a change in risk to institutional operations and assets, individuals, or other organizations;
6.1.7.Obtain legal opinion regarding information system monitoring activities; and
6.1.8.Provide institution-defined information system monitoring information to institution-defined personnel or roles as needed and/or at an institution-defined frequency.
7.1.Component institutions must:
7.1.1.Receive information system security alerts, advisories, and directives from institution-defined external organizations on an ongoing basis.
7.1.2.Generate internal security alerts, advisories, and directives as deemed necessary;
7.1.3.Include, at minimum, the sources identified in the Standards for Security Alerts, Advisories, and Directives in the institution-defined list of external organizations.
7.1.4.Disseminate security alerts, advisories, and directives to institution-defined personnel or roles, institution-defined elements within the institution, and/or institution-defined external organizations; and
7.1.5.To the extent required by law or other regulations, implement security directives in accordance with established time frames or notify the issuing organization of the degree of noncompliance.
8.1.Component institutions must:
8.1.1.Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
8.1.2.Update spam protection mechanisms when new releases are available in accordance with institutional configuration management policy and procedures.
9.1.Component institutions must ensure that each information system checks the validity of institution-defined information inputs.
10.1.Component institutions must manage and retain information within each information system and information output from each information system in accordance with applicable federal laws, executive orders, directives, policies, regulations, standards, and operational requirements.