Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 203 - MANAGEMENT OF ELECTRONIC TRANSACTIONS AND SIGNED RECORDS › Subchapter C - INSTITUTIONS OF HIGHER EDUCATION USE OF ELECTRONIC TRANSACTIONS AND SIGNED RECORDS › Section 203.45 - Acceptable PKI Service Providers

Current through Reg. 49, No. 28; July 12, 2024
(a) The
				  department shall maintain an "Approved List of PKI Service Providers"
				  authorized to issue certificates for digitally signed communications sent to
				  institutions of higher education or otherwise provide services in connection
				  with the issuance of certificates. The list may include, but shall not
				  necessarily be limited to, Certification Authorities, Certificate
				  Manufacturers, Registrars, and/or other PKI Service Providers accepted and
				  approved for use in connection with electronic messages transmitted to other
				  state or federal governmental entities. A copy of such list may be obtained
				  directly from the department, or may be obtained electronically via the
				  department's website.
(b)
				  Institutions of higher education shall only procure, or otherwise implement,
				  certificates from PKI Service Providers that appear on the "Approved List of
				  PKI Service Providers."
(c) The
				  department shall determine whether to place a PKI Service Provider on the
				  "Approved List of PKI Service Providers" after the PKI Service Provider
				  provides the department with a copy of its current certification practice
				  statement, if any, and a copy of an examination report performed in accordance
				  with standards set in the American Institute of Certified Public Accountants
				  (AICPA) Statement on Standards for Attestation Engagement No. 16 (SSAE 16) (or
				  a successor AICPA standard) to ensure that the PKI Service Provider's practices
				  and policies are consistent with the requirements of the PKI Service Provider's
				  certification practice statement, if any, and the requirements of this
				  section.
(d) In order to be placed
				  on the "Approved List of PKI Service Providers" a PKI Service Provider that has
				  been in operation for one year or less shall undertake a SSAE 16 Service
				  Organization Control (SOC) 2 Type 1 examination (or a successor AICPA standard)
				  and the results of the examination must be deemed satisfactory by the
				  department.
(e) In order to be
				  placed on the "Approved List of PKI Service Providers" a PKI Service Provider
				  that has been in operation for longer than one year shall undertake a SSAE 16
				  Service Organization Control (SOC) 2 Type 2 examination (or a successor AICPA
				  standard) and the results of the examination must be deemed satisfactory by the
				  department.
(f) In lieu of the
				  examination requirements of subsections (d) and (e) of this section, a PKI
				  Service Provider may be placed on the "Approved List of PKI Service Providers"
				  upon providing the department with documentation issued by a person independent
				  of the PKI Service Provider that is indicative of the security policies and
				  procedures actually employed by the PKI Service Provider and that is acceptable
				  to the department in its sole discretion. The department may request additional
				  documentation relating to policies and practices employed by the PKI Service
				  Provider indicating the trustworthiness of the technology employed and
				  compliance with applicable department guidelines.
(g) To remain on the "Approved List of PKI
				  Service Providers" a Certification Authority must provide proof of compliance
				  with the examination requirements or other acceptable documentation to the
				  department every two years after initially being placed on the list. In
				  addition, a Certification Authority must provide a copy of any changes to its
				  certification practice statement to the department promptly following the
				  adoption by the Certification Authority of such changes.
(h) If the department is informed that a PKI
				  Service Provider is no longer in full compliance following a required
				  examination and the non-compliance is deemed to be material by the department,
				  or if the department obtains credible information that the technology employed
				  by the PKI Service Provider can no longer reasonably be relied upon, the PKI
				  Service Provider may be removed from the "Approved List of PKI Service
				  Providers" by the department. The effect of the removal of a PKI Service
				  Provider from the "Approved List of PKI Service Providers" shall be to prohibit
				  institutions of higher education from thereafter accepting digital signatures
				  for which the PKI Service Provider issued a certificate or provided services in
				  connection with such issuance for so long as the PKI Service Provider is
				  removed from the list. The removal of a PKI Service Provider from the "Approved
				  List of PKI Service Providers" shall not, in and of itself, invalidate a
				  digital signature for which a PKI Service Provider issued the certificate prior
				  to its removal from the list.