Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.71 - Responsibilities of Information Security Officer

Current through Reg. 49, No. 28; July 12, 2024
(a) Each institution of higher education
				  shall have a designated Information Security Officer in accordance with Texas
				  Government Code §
										RSA
				  2054.136. The Information Security Officer
				  shall report to executive level management, has explicit authority for
				  information security for the entire agency, and complies with all other
				  requirements of Texas Government Code §
										RSA
				  2054.136.
(b) The Information Security Officer shall be
				  responsible for:
(1) developing and
				  maintaining an institution-wide information security plan as required by Texas
				  Government Code §
											RSA
				  2054.133;
(2) developing and maintaining information
				  security policies and procedures that address the requirements of this chapter
				  and the institution's information security risks;
(3) working with the business and technical
				  resources to ensure that controls are utilized to address all applicable
				  requirements of this chapter and the institution's information security
				  risks;
(4) providing for training
				  and direction of personnel with significant responsibilities for information
				  security with respect to such responsibilities;
(5) providing guidance and assistance to
				  senior institution of higher education officials, information owners,
				  information custodians, and end users concerning their responsibilities under
				  this chapter;
(6) ensuring that:
(A) risk assessments are performed by the
				  information-owners and supported by the information-custodians at least
				  biennially for systems containing confidential data and periodically for
				  systems containing institution of higher education sensitive or public data;
				  and
(B) security assessments are
				  conducted biennially for systems containing confidential data and periodically
				  for systems containing institution of higher education sensitive or public
				  data;
(7) reviewing the
				  institution's inventory of information systems and related ownership and
				  responsibilities;
(8) recommending
				  and collaborating to establish policies, procedures, and practices, in
				  cooperation with the institution Information Resources Manager,
				  information-owners and custodians, necessary to ensure the security of
				  information and information resources against unauthorized or accidental
				  modification, destruction, or disclosure;
(9) verifying that security requirements are
				  identified and risk mitigation plans are developed and contractually agreed and
				  obligated prior to the acquisition of new information systems and/or related
				  services and applications;
(10)
				  verifying that security requirements are identified and risk mitigation plans
				  are developed and implemented prior to the deployment of internally-developed
				  information systems and/or related applications or services;
(11) reporting, at least annually, to the
				  agency head the status and effectiveness of the security program and its
				  controls;
(12) informing any
				  relevant parties in the event of noncompliance with this chapter and/or with
				  the institution's information security policies; and
(13) all other duties required by Texas
				  Government Code §
											RSA
				  2054.136.