TTUHSC IT Policies
1.1. I.T. RESOURCE MANAGEMENT AND RESPONSIBILITIES (TAC 202.71, 202.72)
The President has designated the Institutional Information Security Officer (ISO) to review and designate ownership of information resources. The ISO will work with the owners of information resources to develop strategies to meet their required responsibilities and ensure compliance with the associated responsibilities. These responsibilities are to be defined, documented, and provided by the Information Security Officer.
Owner Responsibilities – the owner or their designated representative(s) are responsible for and authorized to:
-
Classify business functional information into the following categories:
-
Confidential information, as defined by TAC 202.1(3), includes:
- Social Security numbers,
- Credit card information,
- Other personal financial information,
- Student records, and
- Patient health information.
-
Confidential information, as defined by TAC 202.1(3), includes:
Additional information can be found in the Attorney General of Texas’ Public Information 2006 Handbook.
-
Restricted Personal information - includes social security numbers or other data protected under state or federal law (e.g., financial, medical, or student data).
- Mission Critical Information - includes information that is essential to HSC operations.
- Non-critical Information - includes information that is generally available to the public or has a minimum impact on HSC customers.
-
Information system owners, in collaboration with the Information Security Officer or designee, shall assess a risk level based on the inherent risk with a ranking of “High”, “Medium”, or “Low”. The criteria for each level are:
-
High Risk
- Involve large dollar amounts, or significantly important information that would impact the operations of the HSC, or
- Contain confidential or sensitive data, or
- Impact a large number of people or networks.
-
Medium Risk
- Involve a moderate or low dollar value, or
- Information that could potentially create problems for the parties involved, or
- Impact a moderate portion of the Institution’s customer base.
-
Low Risk
- Generally available public information, or
- Result in a relatively small impact for the HSC.
-
High Risk
- Approve access and formally assign custody of an information resource asset;
- Specify data control requirements, based on risk assessment, to the custodian and user of the information resource;
- Verify the controls are in place and compliance is met; and
- Review access permissions based on security risk assessment.
Custodian Responsibilities - the custodian of information resources is responsible for:
- Implementing the controls specified by the owner(s),
- Providing physical and procedural safeguards for the resource,
- Assisting owner in evaluating the cost-effectiveness of controls and monitoring, and
- Implementing the monitoring techniques and procedures for detecting, reporting, and investigating incidents.
User Responsibilities - the user of the information resources is responsible for:
- Using the resources only for the designed purpose, and
- Complying with the controls specified by the owner(s).
See Section 1.4.1 for further responsibilities.
Managing Security Risks
A security risk analysis of information resources shall be performed and documented. Annual risk assessments will be conducted on information resources classified as high risk. Biennial risk assessments will be conducted on information resources classified as medium or low risk. Security risk assessment results, vulnerability reports and other security analysis information shall be presented to the President of the HSC or their designated representative(s). The President of the HSC or designated representative(s) shall make the final security risk management decisions to either accept the risks or to modify the security and controls for the information resources based on its value and sensitivity. The President of the HSC or their designated representative(s) must approve the final security risk management plan.