| (a) Each institution of higher education shall have
a designated Information Security Officer in accordance with Texas
Government Code §2054.136. The Information Security Officer shall
report to executive level management, has explicit authority for information
security for the entire agency, and complies with all other requirements
of Texas Government Code § 2054.136.
(b) The Information Security Officer shall be responsible
for:
(1) developing and maintaining an institution-wide
information security plan as required by Texas Government Code §
2054.133;
(2) developing and maintaining information security
policies and procedures that address the requirements of this chapter
and the institution's information security risks;
(3) working with the business and technical resources
to ensure that controls are utilized to address all applicable requirements
of this chapter and the institution's information security risks;
(4) providing for training and direction of personnel
with significant responsibilities for information security with respect
to such responsibilities;
(5) providing guidance and assistance to senior institution
of higher education officials, information owners, information custodians,
and end users concerning their responsibilities under this chapter;
(6) ensuring that:
(A) risk assessments are performed by the information-owners
and supported by the information-custodians at least biennially for
systems containing confidential data and periodically for systems
containing institution of higher education sensitive or public data;
and
(B) security assessments are conducted biennially for
systems containing confidential data and periodically for systems
containing institution of higher education sensitive or public data;
(7) reviewing the institution's inventory of information
systems and related ownership and responsibilities;
(8) recommending and collaborating to establish policies,
procedures, and practices, in cooperation with the institution Information
Resources Manager, information-owners and custodians, necessary to
ensure the security of information and information resources against
unauthorized or accidental modification, destruction, or disclosure;
(9) verifying that security requirements are identified
and risk mitigation plans are developed and contractually agreed and
obligated prior to the acquisition of new information systems and/or
related services and applications;
(10) verifying that security requirements are identified
and risk mitigation plans are developed and implemented prior to the
deployment of internally-developed information systems and/or related
applications or services;
(11) reporting, at least annually, to the agency head
the status and effectiveness of the security program and its controls;
(12) informing any relevant parties in the event of
noncompliance with this chapter and/or with the institution's information
security policies; and
(13) all other duties required by Texas Government
Code § 2054.136.
(c) The Information Security Officer, with the approval
of the agency head, may issue exceptions to information security requirements
or controls in this chapter. Any such exceptions shall be justified,
documented and communicated.
|
| Source Note: The provisions of this §202.71 adopted to be effective March 17, 2015, 40 TexReg 1357; amended to be effective March 16, 2016, 41 TexReg 1831; amended to be effective November 17, 2021, 46 TexReg 7775 |
