Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around system and services acquisition.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.System and information controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Systems and Services Acquisition policy and associated controls;
3.1.2.Review and update System and Information Integrity procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional System and Services Acquisition procedures related to the controls in this policy.
4.1.Component institutions must:
4.1.1.Determine high-level information security requirements for each information system or information system service in mission and business process planning;
4.1.2.Determine, document, and allocate the resources required to protect each information system or information system service as part of its capital planning and investment control process; and
4.1.3.Establish a discrete line item for information security in institutional programming and budgeting documentation.
5.1.Component institutions must:
5.1.1.Acquire, develop, and manage information systems using an institution-defined system development life cycle that incorporates information security considerations;
5.1.2.Define and document information security roles and responsibilities throughout the system development life cycle;
5.1.3.Identify individuals having information security roles and responsibilities; and
5.1.4.Integrate the institutional information security risk management process into system development life cycle activities.
5.2.Component institutions must:
5.2.1.Include information security, security testing, and audit controls in all phases of the system development lifecycle or acquisition process.
6.1.Component institutions must include the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for each information system, information system component, or information system service in accordance with applicable federal/state laws, Executive Orders, directives, policies, regulations, standards, guidelines, and institutional mission/business needs:
6.1.1.Security functional requirements;
6.1.2.Strength of mechanism requirements;
6.1.3.Security assurance requirements;
6.1.4.Controls needed to satisfy the security requirements;
6.1.5.Security-related documentation requirements;
6.1.6.Requirements for protecting security-related documentation;
6.1.7.Description of the information system development environment and environment in which the system is intended to operate;
6.1.8.Allocation of responsibility or identification of parties responsible for information security and supply chain risk management; and
6.1.9.Acceptance criteria.
6.2.Each component institution entering into or renewing a contract with a vendor authorized to access, transmit, use, or store data for the component institution shall include, within or as an addendum to the contract, the “Information Security and Accessibility Standards” Exhibit from the TSUS Contract Management Handbook or, if superseded, the appropriate addendum replacing the exhibit.
7.1.Component institutions must:
7.1.1.Obtain administrator documentation for each information system, information system component, or information system service that describes:
7.1.1.1.Secure configuration, installation, and operation of the system, component, or service;
7.1.1.2.Effective use and maintenance of security functions/mechanisms; and
7.1.1.3.Known vulnerabilities regarding configuration and use of administrative or privileged functions;
7.1.2.Obtain user documentation for each information system, information system component, or information system service that describes:
7.1.2.1.User-accessible security functions and mechanisms and how to effectively use those security functions/mechanisms;
7.1.2.2.Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and
7.1.2.3.User responsibilities in maintaining the security of the system, component, or service and privacy of individuals;
7.1.3.Document attempts to obtain information system, information system component, or information system service documentation when such documentation is either unavailable or nonexistent and take institution-defined actions in response;
7.1.4.Protect documentation as required, in accordance with the institutional risk management strategy; and
7.1.5.Distribute documentation to institution-defined personnel or roles.
8.1.Component institutions must:
8.1.1.Define and establish institutional security engineering principles; and
8.1.2.Apply the security engineering principles in the specification, design, development, implementation, and modification of the information system and information system components.
9.1.Component institutions must:
9.1.1.Require that providers of external information system services comply with institutional information security requirements and employ institution-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;
9.1.2.Define and document institutional oversight and user roles and responsibilities with regard to external information system services; and
9.1.3.Employ institution-defined processes, methods, and techniques to monitor security control compliance by external service providers on an ongoing basis.
10.1.Component institutions must require the developer of each information system, information system component, or information system service to:
10.1.1.Perform configuration management during at least one of the following life cycle stages: design, development, implementation, operation, or disposal;
10.1.2.Document, manage, and control the integrity of changes to institution-defined configuration items under configuration management;
10.1.3.Implement only institution-approved changes to the information system, information system component, or information system service;
10.1.4.Document approved changes to the information system, information component, or information system service and the potential security impacts of such changes; and
10.1.5.Track security flaws and flaw resolution within the information system, information system component, or information system service and report findings to institution-defined personnel.
10.2.Component institutions must require:
10.2.1.The information owner approve all security-related information resources changes for their respective information system(s) through a change control process; and
10.2.2.The approval of such changes to occur prior to the implementation of the security-related information resources changes by the institution or independent contractors.
11.1.Component institutions must require the developer of the information system, information system component, or information system service, at all post-design stages of the system development life cycle, to:
11.1.1.Develop and implement a plan for ongoing security assessments;
11.1.2.Perform the appropriate level and frequency of testing and evaluation based on the classification of data and the security categorization of the information system;
11.1.3.Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
11.1.4.Implement a verifiable flaw remediation process; and
11.1.5.Correct flaws identified during testing and evaluation.
12.1.Component institutions must:
12.1.1.Replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
12.1.2.Provide alternative sources for continued support for unsupported components (e.g., support from external providers, in-house support if technically feasible).