TTUHSC IT Policies
1. SECURITY
1.1. I.T. RESOURCE MANAGEMENT AND RESPONSIBILITIES (TAC 202.71, 202.72)
Information Security Program
Each state agency head or his or her designated representative(s) shall designate an Information Security Officer (ISO) to administer the state agency Information Security Program. The ISO shall report to executive level management. TTUHSC's Information Security Program will be reviewed annually for compliance with TAC 202 standards. Other responsibilities of the ISO include the following:
-
- Document and maintain an up-to-date information security program. The information security program shall be approved by the institution of higher education head or his or her designated representative(s).
- Develop recommended policies and establish procedures and practices, in cooperation with information owners and custodians, necessary to ensure the security of information resources assets against unauthorized or accidental modification, destruction or disclosure.
- Monitor the effectiveness of defined controls for mission critical information.
- Report, at least annually, to the institution of higher education head or his or her designated representative(s) the status and effectiveness of information resources security controls.
- Issue exceptions to information security requirements or controls in this chapter. Any such exceptions shall be justified, documented, and communicated as part of the risk assessment process.
- Work with the owners of information resources to develop strategies to meet their required responsibilities and to ensure compliance.
Defined Responsibilities
Information Owner Responsibilities – the owner or their designated representative(s) are responsible for and authorized to:
- Approve access and formally assign custody of an information resources asset
- Determine the asset's value
- Specify data control requirements and convey them to users and custodians
- Specify appropriate controls, based on a risk assessment, to protect the state's information resources from unauthorized modification, deletion, or disclosure. Controls shall extend to information resources and services outsourced by the institution of higher education.
- Confirm that controls are in place to ensure confidentiality, integrity, and availability of data and other assigned information resources.
- Assign custody of information resources assets and provide appropriate authority to implement security controls and procedures
- Review access lists based on documented security risk management decisions
- Approve, justify, document and be accountable for exceptions to security controls. The information owner shall coordinate exceptions to security controls with the ISO or other person(s) designated by the state institution of higher education head.
- Classify business functional information
Custodians of information resources shall:
- Implement the controls specified by the owner(s),
- Provide physical, technical, and procedural safeguards for the information resources,
- Assist information owners in evaluating the cost-effectiveness of controls and monitoring, and
- Implement monitoring techniques and procedures for detecting, reporting, and investigating incidents.
User Responsibilities - the user of the information resources is responsible for:
- Using the resources only for the designed purpose, and
- Complying with the controls specified by the owner(s).
- Information system owners, in collaboration with the Information Security Officer or designee, shall assess a risk level based on the inherent risk with a ranking of “High”, “Medium”, or “Low”. The criteria for each level are:
|
High Risk |
Medium Risk |
Low Risk |
|
Involve large dollar amounts, or significantly important information that would impact the operations of the HSC, or |
Involve a moderate or low dollar value, or |
Generally available public information, or |
|
Contain confidential or sensitive data, or |
Information that could potentially create problems for the parties involved, or |
Result in a relatively small impact for the HSC |
|
Impact a large number of people or networks |
Impact a moderate portion of the Institution’s customer base |
|
- See Policy 1.4.1 for further responsibilities.
- A system change could cause the overall classification to move to another risk level
Managing Security Risks
A security risk analysis of information resources shall be performed and documented on the following schedule:
- Annually on information resources classified as high risk
- Biennially on information resources classified as medium or low risk
Security risk assessment results, vulnerability reports and other security analysis information shall be presented to the President of the HSC or their designated representative(s). The President of the HSC or designated representative(s) shall make the final security risk management decisions to either accept the risks or to modify the security and controls for the information resources based on its value and sensitivity. The President of the HSC or their designated representative(s) must approve the final security risk management plan.
1.2 MANAGING PHYSICAL SECURITY (TAC 202.73)
Access to I.T. Data Centers will be documented and controlled. Only authorized personnel will have access to any Institutional Data Center. An annual review of the physical security measures of the Data Centers will be conducted by the Information Security Officer. Data Center personnel will be trained to monitor environmental controls and trained in appropriate responses to emergencies or equipment problems. Appropriate safety procedures, as defined by the Safety Services Department and outlined in the I.T. Division’s Disaster Recovery Plan will be followed and annual tests conducted. Additionally, TTUHSC will refer to the State Office of Risk Management for applicable rules and guidelines.
1.3 DISASTER RECOVERY (TAC 202.74)
This policy sets forth the guidelines and procedures for recovering the Data Center and all related information systems providing service to the Institution. In accordance with the Texas Administrative Code Rule §202.72, Business Continuity Planning, the I.T. Division shall develop and maintain a Disaster Recovery Plan (DRP) that delineates all the roles and responsibilities for the individual Disaster Recovery Teams, along with the steps that must be taken for successful recovery operations.
At a minimum, the DRP shall be tested annually or when a major revision occurs and I.T. staff assigned to disaster recovery duties shall be trained, at least, on an annual basis.
In the even of a disaster,
- The Chief Information Officer (CIO) is the only authority for declaring a disaster for the Data Center and all related I.T. services based on the findings of the Tactical Operations Team.
- The Tactical Operations Team is responsible for the timely identification and determination of the disaster as well as the duration of the service outage.
Upon the declaration of a disaster,
- The I.T. Division and all associated Disaster Recovery Teams will invoke and comply with the procedures documented in the DRP.
- All efforts will be made to accommodate user needs while recovery services are being implemented but prioritization of recovery will be based on the criticality of the service and/or application experiencing the outage.
- The Office of Communications and Marketing is the only authority for all media communications based on information from the Chief Information Officer.
- The Chief Information Officer or designee from the Management Team is responsible for conveying all necessary information to the Office of Communications and Marketing for any updates and/or announcements to the media.
TTUHSC Information Resources backup and recovery process for each system must be documented and periodically reviewed. A process must be implemented to verify the success of the electronic information backup.
Backups must be periodically tested to ensure that they are recoverable.
1.4 SECURITY SAFEGUARDS (TAC 202.75)
1.4.2. Account Management And User Responsibilities
1.4.3. Administrator/Special Access
1.4.8. Internet And Intranet Connectivity
1.4.12. Password/Authentication
1.4.16. Monitoring Of I.T. Assets
1.4.17. Security Awareness And Training
1.4.20. Application System Development, Acquisition, And Lifecycle