reglab/statecodes huggingface dataset:
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 174 - INDIGENT DEFENSE POLICIES AND STANDARDS › Subchapter C - POLICY MONITORING REQUIREMENTS › Division 2 - POLICY MONITORING PROCESS AND BENCHMARKS › Section 174.27 - Risk Assessment

Current through Reg. 49, No. 28; July 12, 2024
(a) A risk
					 assessment of each county shall be conducted by the policy monitoring team each
					 fiscal year as the primary means of determining which counties will be selected
					 for on-site policy monitoring. On-site monitoring visits to counties shall then
					 be apportioned by administrative judicial region, county size, risk assessment
					 scores, past visits, and other documented factors. The risk assessment shall
					 use a variety of factors related to the provision of indigent defense services,
					 including but not limited to the following:
(1) Investigation and expert witness
					 expenses;
(2) Reimbursements for
					 attorney fees;
(3) Per capita
					 indigent defense expenses;
(4)
					 Felony, misdemeanor, and juvenile attorney appointment rates;
(5) County population;
(6) Complaints about a county received by the
					 Commission;
(7) Receipt of a TIDC
					 improvement grant;
(8) Requests for
					 counsel during magistrate warnings under Article
					 RSA 15.17,
					 Code of Criminal Procedure; and
(9)
					 Appellate cases.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 174 - INDIGENT DEFENSE POLICIES AND STANDARDS › Subchapter C - POLICY MONITORING REQUIREMENTS › Division 2 - POLICY MONITORING PROCESS AND BENCHMARKS › Section 174.28 - On-Site Monitoring Process

Current through Reg. 49, No. 28; July 12, 2024
(a)
					 Purpose. The process promotes local compliance with the requirements of the
					 Fair Defense Act and Commission rules and provides technical assistance to
					 improve processes where needed.
(b)
					 Monitoring Process. The policy monitor examines the local indigent defense
					 plans and local procedures and processes to determine if the jurisdiction meets
					 the statutory requirements and rules adopted by the Commission. The policy
					 monitor also attempts to randomly select samples of actual cases from the
					 period of review by using a 15% confidence interval for a population at a 95%
					 confidence level.
(c) Core
					 Requirements. On-site policy monitoring focuses on the six core requirements of
					 the Fair Defense Act and related rules. Policy monitoring may also include a
					 review of statutorily required reports to the Office of Court Administration
					 and Commission. This rule establishes the process for evaluating policy
					 compliance with a requirement and sets benchmarks for determining whether a
					 county is in substantial policy compliance with the requirement. For each of
					 these elements, the policy monitor shall review the local indigent defense
					 plans and determine if the plans are in compliance with each element.
(1) Prompt and Accurate Magistration.
(A) The policy monitor shall check for
					 documentation indicating that the magistrate or county has:
(i) Informed and explained to an arrestee the
					 rights listed in Article
					 RSA
					 15.17(a), Code of Criminal
					 Procedure, including the right to counsel;
(ii) Maintained a process to magistrate
					 arrestees within 48 hours of arrest;
(iii) Maintained a process for magistrates
					 not authorized to appoint counsel to transmit requests for counsel to the
					 appointing authority within 24 hours of the request; and
(iv) Maintained magistrate processing records
					 required by Article 15.17(a), (e), and (f), Code of Criminal Procedure, and
					 records documenting the time of arrest, time of magistration, whether the
					 person requested counsel, and time for transferring requests for counsel to the
					 appointing authority.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 174 - INDIGENT DEFENSE POLICIES AND STANDARDS › Subchapter D - INDIGENT DEFENSE PROCEDURE REQUIREMENTS › Section 174.51 - Indigent Defense Plan Requirements

Current through Reg. 49, No. 28; July 12, 2024
The countywide procedures adopted under Art. 26.04(a), Code
					 of Criminal Procedure, must provide a method to allow defendants to obtain the
					 necessary forms for requesting appointment of counsel and to submit completed
					 forms for requesting appointment of counsel at any time after the initiation of
					 adversary judicial proceedings.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 176 - METHODS FOR THE IMPROVEMENT OF THE ADMINISTRATION OF JUSTICE › Section 176.1 - Admonishment by Court of Certain Persons Ineligible to Possess Firearm or Ammunition

Current through Reg. 49, No. 28; July 12, 2024
(a) In this
				section, "Firearm" has the meaning assigned that term by Penal Code §
									RSA
				46.01(3).
(b) When a person, by entry of an order or
				judgment, becomes by state law ineligible to possess a firearm or ammunition,
				the trial court must inform that person of the person's ineligibility to
				possess a firearm or ammunition.
(1) If the
				person is appearing before the court when the person is or becomes ineligible,
				the court must:
(A) orally admonish the
				person, in a manner the person can understand, that the person is ineligible to
				possess a firearm or ammunition; and
(B) provide the person with a written
				admonishment informing that person of the person's ineligibility to possess a
				firearm or ammunition.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 176 - METHODS FOR THE IMPROVEMENT OF THE ADMINISTRATION OF JUSTICE › Section 176.2 - Voluntary Certification for Remote Issuance of Marriage Licenses

Current through Reg. 49, No. 28; July 12, 2024
(a) A county clerk may apply for
				certification from the Office of Court Administration to use remote technology
				to receive applications for marriage licenses from, and to issue marriage
				licenses to, persons who are not in the county clerk's presence.
(b) The Office of Court Administration must
				certify a county clerk to issue marriage licenses remotely upon determining the
				county clerk:
(1) has posted in a prominent
				location on its website:
(A) contact
				information for scheduling a meeting through remote technology to apply for a
				marriage license;
(B) a copy of the
				marriage license application form required by Section
				RSA 2.004 of the
				Family Code; and
(C) a list of the
				acceptable forms of proof of an applicant's identity and age as specified in
				Section
				RSA
				2.005 of the Family Code; and
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 176 - METHODS FOR THE IMPROVEMENT OF THE ADMINISTRATION OF JUSTICE › Section 176.3 - Verification of Age and Identity of Applicant for a Marriage License

Current through Reg. 49, No. 28; July 12, 2024
(a) A county clerk must verify the age and
				identity and, if applicable, proof of the removal of disability of minority of
				an applicant who appears before the clerk through remote technology. The county
				clerk may do so by:
(1) examining via remote
				video an acceptable form of proof of age and identity specified in Section
				RSA
				2.005 of the Family Code and, if applicable,
				the court order described in Section
				RSA
				2.003 of the Family Code;
(2) examining an electronically transmitted
				copy of an acceptable form of proof of age and identity listed in Section
				RSA
				2.005 of the Family Code and, if applicable,
				the court order described in Section
				RSA
				2.003 of the Family Code;
(3) witnessing an oath by a notary who is in
				the applicant's presence verifying the authenticity of the applicant's proof of
				age and identity and, if applicable, a court order described in Section
				RSA
				2.003 of the Family Code; or
(4) collecting an affidavit of a notary
				swearing to the age, identity, and, if applicable, legal capacity of the
				applicant.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 177 - JUDICIAL COMMITTEE ON INFORMATION TECHNOLOGY › Section 177.1 - Definitions

Current through Reg. 49, No. 28; July 12, 2024
The following words and terms, when used in this chapter,
				  have the following meanings, unless the context clearly indicates
				  otherwise.
(1) Court--Any judge who
				hears criminal cases or child support cases, and the office of the clerk that
				supports any such judge.
(2)
				Information Exchange Package Document (IEPD)--A specification for a data
				exchange which defines a particular data exchange between participating
				domains. An IEPD is a complete definition of an Information Exchange Package;
				it is generally composed of schemas (for data exchange) and documentation (for
				understanding the business context and usage).
(3) Justice agency--The Texas Department of
				Criminal Justice (TDCJ), the Department of Public Safety (DPS), the Texas Youth
				Commission (TYC), the Texas Juvenile Probation Commission (TJPC), the Office of
				Attorney General Child Support Division (OAG), the Office of Court
				Administration (OCA), the Department of Family and Protective Services (DFPS),
				any sheriff or local law enforcement agency that employs a peace officer as
				defined in art.2.12, Code of Criminal Procedure, any community supervision and
				corrections department, any public defender office, any constable, any office
				of a county or district attorney or criminal district attorney, any private
				process server, and any agency that receives delinquent child support
				notifications from the Office of Attorney General Child Support Division or
				from a court.
(4) Justice
				information data exchanges--Exchanges of information pertaining to criminal,
				juvenile, and family law matters or cases.
(5) NIEM--The National Information Exchange
				Model, a reference model that is the result of a collaborative effort between
				the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland
				Security (DHS) that extends the data exchange standards implemented by the DOJ
				Global Justice Information Sharing Initiative (the Global Justice XML Data
				Model). Further information is available at www.niem.gov.
(6) Texas Path to NIEM--The local and state
				justice agency collaborative work project for implementing NIEM in
				Texas.
(7) XML--Extensible markup
				language.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 8 - TEXAS JUDICIAL COUNCIL › Chapter 177 - JUDICIAL COMMITTEE ON INFORMATION TECHNOLOGY › Section 177.2 - NIEM Conformance

Current through Reg. 49, No. 28; July 12, 2024
(a) Justice
				information data exchanges between courts or between a court and OCA shall
				conform with the IEPDs developed by Texas Path to NIEM.
(b) Justice agencies are encouraged to
				develop justice information systems whose data exchanges conform with the IEPDs
				developed by Texas Path to NIEM, and justice information data exchanges between
				justice agencies or between a court and a justice agency with such capabilities
				shall conform with those IEPDs.
(c)
				These standards apply to justice information data exchanges between systems
				whose development is initiated on or after September 1, 2009.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.2 - Historically Underutilized Business Program

Current through Reg. 49, No. 28; July 12, 2024
Pursuant to Texas Government Code §
									RSA
				  2161.003, the department adopts by reference
				  the Historically Underutilized Business Program rules of the State of Texas
				  Procurement authority, as such rules may be amended by the authority from time
				  to time. The rules may be found at 34 TAC Chapter 20, Subchapter B or may be
				  obtained by contacting the department's HUB coordinator at (512) 475-4700 or
				  through electronic mail at DIRINFO@dir.texas.gov.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.3 - Assignment of Department Vehicles

Current through Reg. 49, No. 28; July 12, 2024
(a)
				Purpose and Intent. The purpose of this rule is to implement the provisions of
				Texas Government Code §
									RSA
				2171.1045.
(b) Department vehicles are available for
				conducting official department business. Vehicles may be assigned to specific
				field employees or available for checkout for use by employees conducting
				official department business.
(c)
				The department may assign a vehicle to an individual administrative or
				executive employee on a regular or everyday basis only if the department
				determines that the assignment is critical to the needs and mission of the
				department. The determination shall be documented and maintained in
				writing.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.5 - Advisory Committees

Current through Reg. 49, No. 28; July 12, 2024
(a) State
				Strategic Plan for Information Resources Management Advisory Committee.
(1) This advisory committee shall consist of
				at least nine and not more than 21 members appointed by the department
				Executive Director with the approval of the board. Members should have a
				demonstrated ability to think strategically and to work towards consensus
				building in a committee setting. The membership will include at least:
(A) two information resources managers, or a
				designee, from Texas state agencies other than a university system or
				institution of higher education as defined in Education Code, §
											RSA
				61.003;
(B) one representative from a state
				university system or institution of higher education as defined in Education
				Code, §
											RSA
				61.003;
(C) one member of the public;
(D) one representative from a local
				government organization in the state that is knowledgeable about computing
				and/or telecommunications;
(E)
				three representatives from the computing and/or telecommunications
				industry;
(F) one representative
				from a federal agency that is knowledgeable about computing and/or
				telecommunications.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.6 - Contract Approval Authority and Responsibilities

Current through Reg. 49, No. 28; July 12, 2024
(a) Purpose. The purpose of this rule is to
				establish the approval authority and responsibilities for executing contracts
				required by the department.
(b)
				Applicability. This rule applies to all contracts entered into by the
				department.
(c) Definitions. As
				used in this section, the following terms shall have the following meanings,
				unless the context clearly indicates otherwise.
(1) Board--The governing board of the
				department.
(2) Contract--A written
				agreement between the department and a contractor for goods or services. As
				used in this section, "contract" includes the following: letters of agreement;
				interagency/interlocal agreements with other government entities; and other
				documents in which state funds or services allocated to the department are
				exchanged for the delivery of other goods or services.
(3) Major Outsourced Contract--A contract the
				department executes with entities other than this state or a political
				subdivision of this state that:
(A) is
				authorized under Government Code, Chapter 2054, Subchapter I or Subchapter L,
				or Chapter 2170; or
(B) exceeds the
				monetary threshold in subsection (d)(1)(A) of this section, other than those
				contracts described in subparagraph (A) of this paragraph.
(4) Value--The department adopts by reference
				the determination of contract value set forth in the State of Texas Contract
				Management Guide. The determination of contract value shall include, in
				addition to compensation to a contractor from funds allocated to the
				department, an amount deposited into the State general revenue fund or other
				state fund in a revenue sharing contract arrangement with a
				contractor.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.7 - Negotiated Rulemaking and Alternative Dispute Resolution

Current through Reg. 49, No. 28; July 12, 2024
(a) Policy. It is the department's policy to
				encourage the use of negotiated rulemaking and alternative dispute resolution
				procedures in appropriate situations.
(b) Negotiated Rulemaking. When the
				department finds that a rule to be proposed is likely to be complex,
				controversial, or affect disparate groups, the department may propose to engage
				in negotiated rulemaking in accordance with Government Code, Chapter 2008.
(1) When negotiated rulemaking is considered,
				the department's General Counsel, or designee, shall be the department's
				negotiated rulemaking convener.
(A) The
				convener shall assist in identifying persons who are likely to be affected by a
				proposed rule, including those who oppose issuance of a rule. The convener
				shall discuss with those persons or their representatives as provided in
				Government Code §
											RSA
				2008.052(c).
(B) The convener shall then recommend to the
				department whether negotiated rulemaking is a feasible method to develop the
				proposed rule and shall report to the agency on the relevant considerations,
				including those listed in Government Code §
											RSA
				2008.052(d).
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.8 - Plans and Reports Required of Institutions of Higher Education

Current through Reg. 49, No. 28; July 12, 2024
(a) In compliance with Government Code,
				§
									RSA
				2054.1211, an institution of higher education
				shall prepare and submit the following plans and reports to the department:
(1) Reports as set forth in §
										RSA
				2054.052, Texas Government Code;
(2) Information Resources Managers' training
				and continuing education compliance reports as set forth in §
										RSA
				2054.076, Texas Government Code;
(3) Vulnerability reports as set forth in
				§
										RSA
				2054.077, Texas Government Code;
(4) Information Resources Deployment Review
				as set forth in §
										RSA
				2054.0965, Texas Government Code, subject to
				the reporting limitation in §
										RSA
				51.406, Texas Education Code;
(5) Information Security Plan as set forth in
				§
										RSA
				2054.133, Texas Government Code;
(6) Network configuration information as set
				forth in §
										RSA
				2054.203, Texas Government Code;
(7) Accessibility Survey as set forth in
				§
										RSA
				2054.464, Texas Government Code.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 201 - GENERAL ADMINISTRATION › Section 201.9 - Petition for the Adoption of a Rule

Current through Reg. 49, No. 28; July 12, 2024
(a)
				Purpose. This section provides procedures for any interested person
				(petitioner) to request the department to adopt a rule.
(b) Content of Petition.
(1) The petition must be in writing. No form
				is required but all information must be provided, or a reason why required
				information cannot be provided.
(2)
				The petition must contain the following:
(A)
				petitioner's name, address, organization or affiliation, if any, and the name
				of the person or entity on whose behalf the petition is filed, if different
				from the person submitting the petition;
(B) a plain and brief statement about why a
				rule or change in an existing rule is needed, required, or desirable, including
				the public good to be served and any effect on those who would be required to
				comply with the rule;
(C) an
				estimate of the fiscal impact on state and local government as a result of
				enforcing or administering the proposed rule, an estimate of the economic
				impact on persons required to comply with the proposed rule, whether there may
				be an effect on local employment, and the facts, assumptions and methodology
				used to prepare estimates and impacts required by this subparagraph;
(D) a statement on the department's authority
				to adopt the proposed rule;
(E) the
				proposed text of a new rule, or proposed changes to an existing rule;
				and
(F) a list of individuals,
				organizations or affiliations that may be interested or affected by the
				proposed rule, if known.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter A - DEFINITIONS AND RESPONSIBILITIES › Section 202.2 - Institution of Higher Education

Current through Reg. 49, No. 28; July 12, 2024
A university system or institution of higher education as
					 defined by Texas Education Code §
										RSA
					 61.003.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter A - DEFINITIONS AND RESPONSIBILITIES › Section 202.3 - State Agency

Current through Reg. 49, No. 28; July 12, 2024
A department, commission, board, office, council,
					 authority, or other agency in the executive or judicial branch of state
					 government, other than an institution of higher education, that is created by
					 the constitution or a statute of this state.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter A - DEFINITIONS AND RESPONSIBILITIES › Section 202.4 - Responsibilities of the State's Chief Information Security Officer

Current through Reg. 49, No. 28; July 12, 2024
The State's Chief Information Security Officer shall
					 oversee the development of a statewide information security framework and
					 statewide information security policies and standards, including:
(1) Providing information security
				  leadership, strategic direction, and coordination for the State and State
				  Information Security program;
(2)
				  Developing and overseeing the implementation of policies, standards, and
				  guidelines on information security;
(3) Coordinating the development of policies,
				  standards, and guidelines with agencies, governmental entities, and offices
				  operating or exercising control of State systems or State-controlled
				  data;
(4) Providing strategic
				  direction to the State Network Security Operations Center and Statewide
				  Technology Centers; and
(5)
				  Reporting to the Executive Director of the department and state leadership the
				  status and effectiveness of the State Information Security Program.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter A - DEFINITIONS AND RESPONSIBILITIES › Section 202.5 - Texas Risk and Authorization Management Program Responsibilities and Mandatory Standards

Current through Reg. 49, No. 28; July 12, 2024
(a) Mandatory
				  Standards for Cloud Computing Services Subject to the Texas Risk and
				  Authorization Management Program.
(1) The
				  department shall define mandatory standards for Texas cloud computing services
				  identified by subsection (a) of this section in the program manual published on
				  the department's website. Revisions to this document will be executed in
				  compliance with subsection (d) of this section.
(2) The mandatory standards established by
				  the department shall include at least the below stated baseline standards for:
(A) TX-RAMP Level 1 Baseline - This baseline
				  is required for cloud computing services that are subject to TX-RAMP
				  certification and categorized by a state agency as Low Impact Information
				  Resources; and
(B) TX-RAMP Level 2
				  Baseline - This baseline is required for cloud computing services that are
				  subject to TX-RAMP and categorized by a state agency as Moderate or High Impact
				  Information Resources.
(3) The department shall establish the
				  categories and characteristics of cloud computing services that are subject to
				  TX-RAMP requirements in the program manual published on the department's
				  website pursuant to subsection (a)(1).
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.20 - Responsibilities of the Agency Head

Current through Reg. 49, No. 28; July 12, 2024
(a) The
				  agency head of each state agency is ultimately responsible for the agency's
				  information resources.
(b) The
				  agency head or their designated representative shall:
(1) designate an Information Security Officer
				  who has the explicit authority and the duty to administer the information
				  security requirements of this chapter agency wide;
(2) allocate resources for ongoing
				  information security remediation, implementation, and compliance activities
				  that reduce risk to a level acceptable to the agency head;
(3) ensure that senior agency officials and
				  information-owners, in collaboration with the Information Resources Manager and
				  Information Security Officer, support the provision of information security for
				  the information systems that support the operations and assets under their
				  direct or indirect (e.g., cloud computing or outsourced) control;
(4) ensure that the state agency has trained
				  personnel to assist the agency in complying with the requirements of this
				  chapter and related policies;
(5)
				  ensure that senior agency officials support the state agency Information
				  Security Officer in developing, at least annually, a report on the state agency
				  information security program as specified in §
											RSA
				  202.21(b)(10) and §
											RSA
				  202.23(a) of this
				  chapter;
(6) approve high residual
				  risk management decisions as required by §
											RSA
				  202.25(4) of this
				  chapter;
(7) review and approve at
				  least annually the agency information security program required under §
											RSA
				  202.24 of this chapter; and
(8) ensure that information security
				  management processes are integrated with state agency strategic and operational
				  planning processes.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.22 - Staff Responsibilities

Current through Reg. 49, No. 28; July 12, 2024
(a) Information
				  owners, custodians, and users of information resources shall, in consultation
				  with the state agency Information Resources Manager and Information Security
				  Officer, be identified and their responsibilities defined and documented by the
				  state agency. The following distinctions among owner, custodian, and user
				  responsibilities should guide determination of these roles:
(1) Information Owner Responsibilities. The
				  owner or their designated representative(s) are responsible for:
(A) classifying information under their
				  authority or responsibility, with the concurrence of the agency head or their
				  designated representative(s), in accordance with the state agency's established
				  information classification categories;
(B) approving access to information resources
				  and periodically reviewing access lists based on documented risk management
				  decisions;
(C) formally assigning
				  custody of information or an information resource;
(D) coordinating data security control
				  requirements with the Information Security Officer;
(E) conveying data security control
				  requirements to custodians;
(F)
				  providing authority to custodians to implement security controls and
				  procedures;
(G) justifying,
				  documenting, and being accountable for exceptions to security controls issued
				  by the Information Security Officer for the information for which the
				  Information Owner is responsible;
(H) coordinating and obtaining approval for
				  exceptions to security controls with the state agency Information Security
				  Officer; and
(I) performing risk
				  assessments as provided under §
												RSA
				  202.25 of this chapter.
(J) Information owners, in coordination with
				  the information custodian, shall ensure that information resources provide a
				  clear and conspicuous prohibition against unauthorized access or use as
				  detailed by Texas Penal Code §
												RSA
				  33.02(b-1).
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.23 - Security Reporting

Current through Reg. 49, No. 28; July 12, 2024
(a) Each
				  Information Security Officer shall directly report to the agency head, at least
				  annually, on the adequacy and effectiveness of information security policies,
				  procedures, practices, compliance with the requirements of this chapter, and:
(1) effectiveness of current information
				  security program and status of key initiatives;
(2) residual risks identified by the state
				  agency risk management process; and
(3) state agency information security
				  requirements and requests.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.24 - Agency Information Security Program

Current through Reg. 49, No. 28; July 12, 2024
(a) Each state agency shall develop,
				  document, and implement an agency-wide information security program, approved
				  by the agency head under §
										RSA
				  202.20 of this chapter, that includes
				  protections based on risk for all information and information resources owned,
				  leased, or under the custodianship of any department, operating unit, or
				  employee of the state agency including outsourced resources to another state
				  agency, contractor, or other source (e.g., cloud computing). The program shall
				  include:
(1) periodic assessments in
				  alignment with minimum legal reporting requirements of the risk and impact that
				  could result from the unauthorized access, use, disclosure, disruption,
				  modification, or destruction of information, information systems, and
				  applications that support the operations and assets of the agency;
(2) policies, controls, standards, and
				  procedures that:
(A) are based on the risk
				  assessments required by §
												RSA
				  202.25 of this chapter;
(B) cost-effectively reduce information
				  security risks to a level acceptable to the agency head;
(C) ensure that information security is
				  addressed throughout the lifecycle of agency information resources;
				  and
(D) ensure compliance with:
(i) the requirements of this
				  subchapter;
(ii) minimally
				  acceptable system configuration requirements as determined by the state agency;
				  and
(iii) the control catalog
				  published by the department;
(3) strategies to address risk to high impact
				  information resources;
(4) plans
				  for providing information security for networks, facilities, and systems or
				  groups of information systems and applications based on risk;
(5) a process for planning, implementing,
				  evaluating, and documenting remedial action to address any deficiencies in the
				  information security policies, procedures, and practices of the agency;
				  and
(6) a process to justify,
				  grant, and document any exceptions to specific program requirements in
				  accordance with requirements and processes defined in this chapter.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.25 - Managing Security Risks

Current through Reg. 49, No. 28; July 12, 2024
A risk assessment of the agencies' information and
					 information systems shall be performed and documented.
(1) Risks and impacts will be ranked, at a
				  minimum, as either "High," "Moderate," or "Low. "
(2) The schedule of the future risk
				  assessments will be documented.
(3)
				  Risk assessment results, vulnerability reports, and similar information shall
				  be documented and presented to the Information Security Officer or their
				  designated representative(s).
(4)
				  Approval of the security risk acceptance, transference, or mitigation decision
				  shall be the responsibility of:
(A) the
				  Information Security Officer or their designee(s), in coordination with the
				  information owner, for systems identified with a Low or Moderate residual
				  risk.
(B) The agency head for all
				  systems identified with a High residual risk.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.26 - Security Control Standards Catalog

Current through Reg. 49, No. 28; July 12, 2024
(a)
				  Mandatory Requirements. Mandatory security controls shall be defined by the
				  department in a Control Standards document published on the department's
				  website.
(b) Minimum Requirements
				  for Security Controls. The controls required by subsection (a) of this section
				  shall include:
(1) minimum information
				  security requirements for all State information, information systems, and
				  applications; and
(2) standards to
				  be used by all agencies to provide levels of information security according to
				  risk categorizations.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter B - INFORMATION SECURITY STANDARDS FOR STATE AGENCIES › Section 202.27 - Texas Risk and Authorization Management Program for State Agencies

Current through Reg. 49, No. 28; July 12, 2024
A state agency contracting for cloud computing services
					 that store, process, or transmit data of the state agency shall:
(1) confirm that vendors contracting with the
				  state agency to provide cloud computing services for the state agency are
				  certified through TX-RAMP prior to entering or renewing a cloud computing
				  services contract on or after January 1, 2022; and
(2) require a vendor contracting with the
				  state agency to provide cloud computing services for the state agency that are
				  subject to the state risk and authorization management program to maintain
				  TX-RAMP compliance and certification throughout the term of the
				  contract.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.70 - Responsibilities of the Institution Head

Current through Reg. 49, No. 28; July 12, 2024
(a)
				  The agency head of each state institution of higher education is ultimately
				  responsible for the security of state information resources.
(b) The agency head or their designated
				  representative, shall:
(1) designate an
				  Information Security Officer who has the explicit authority and the duty to
				  administer the information security requirements of this chapter institution
				  wide;
(2) allocate resources for
				  ongoing information security remediation, implementation, and compliance
				  activities that reduce risk to a level acceptable to the institution
				  head;
(3) ensure that senior
				  institution of higher education officials and information-owners, in
				  collaboration with the Information Resources Manager and Information Security
				  Officer, support the provision of information security for the information
				  systems that support the operations and assets under their direct or indirect
				  (e.g., cloud computing or outsourced) control;
(4) ensure that the institution of higher
				  education has trained personnel to assist the institution of higher education
				  in complying with the requirements of this chapter and related
				  policies;
(5) ensure that senior
				  institution of higher education officials support the institution of higher
				  education Information Security Officer in developing, at least annually, a
				  report on institution of higher education information security program, as
				  specified in §
											RSA
				  202.71(b)(10) and §
											RSA
				  202.73(a) of this
				  chapter;
(6) approve high residual
				  risk management decisions as required by §
											RSA
				  202.75(4) of this
				  chapter;
(7) review and approve at
				  least annually institution of higher education information security program
				  required under §
											RSA
				  202.74 of this chapter; and
(8) ensure that information security
				  management processes are part of the institution of higher education strategic
				  planning and operational processes.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.72 - Staff Responsibilities

Current through Reg. 49, No. 28; July 12, 2024
(a) Information
				  owners, custodians, and users of information resources shall, in consultation
				  with the institution Information Resources Managers and Information Security
				  Officer, be identified and their responsibilities defined and documented by the
				  state institution of higher education. The following distinctions among owner,
				  custodian, and user responsibilities should guide determination of these roles:
(1) Information Owner Responsibilities. The
				  owner or their designated representative(s) are responsible for:
(A) classifying information under their
				  authority or responsibility with the concurrence of the agency head or their
				  designated representative(s), in accordance with the institution of higher
				  education's established information classification categories;
(B) approving access to information resources
				  and periodically reviewing access lists based on documented risk management
				  decisions;
(C) formally assigning
				  custody of information or an information resource;
(D) coordinating data security control
				  requirements with the Information Security Officer;
(E) conveying data security control
				  requirements to custodians;
(F)
				  providing authority to custodians to implement security controls and
				  procedures;
(G) justifying,
				  documenting, and being accountable for exceptions to security controls issued
				  by the Information Security Officer for the information for which the
				  Information Owner is responsible;
(H) coordinating and obtaining approval for
				  exceptions to security controls with the agency Information Security Officer;
				  and
(I) performing risk assessments
				  as provided under 1 Texas Administrative Code §
												RSA
				  202.75.
(J) Information owners, in coordination with
				  the information custodian, shall ensure that information resources provide a
				  clear and conspicuous prohibition against unauthorized access or use as
				  detailed by Texas Penal Code §
												RSA
				  33.02(b-1).
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.73 - Security Reporting

Current through Reg. 49, No. 28; July 12, 2024
(a) Each
				  Information Security Officer shall directly report to the agency head, at least
				  annually, on the adequacy and effectiveness of information security policies,
				  procedures, practices, compliance with the requirements of this chapter, and:
(1) effectiveness of current information
				  security program and status of key initiatives;
(2) residual risks identified by the
				  institution of higher education risk management process; and
(3) institution of higher education
				  information security requirements and requests.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.74 - Institution Information Security Program

Current through Reg. 49, No. 28; July 12, 2024
(a) Each institution of higher education
				  shall develop, document, and implement an institution of higher education-wide
				  information security program, approved by the agency head or delegate under 1
				  Texas Administrative Code §
										RSA
				  202.70, that includes protections based on
				  risk for all information and information resources owned, leased, or under the
				  custodianship of any department, operating unit, or employee of the institution
				  of higher education including outsourced resources to another institution of
				  higher education, contractor, or other source (e.g., cloud computing). The
				  program shall include:
(1) periodic
				  assessments in alignment with minimum legal reporting requirements of the risk
				  and impact that could result from the unauthorized access, use, disclosure,
				  disruption, modification, or destruction of information, information systems,
				  and applications that support the operations and assets of the institution of
				  higher education;
(2) policies,
				  controls, standards, and procedures that:
(A)
				  are based on the risk assessments required by 1 Texas Administrative Code
				  §
												RSA
				  202.75;
(B) cost-effectively reduce information
				  security risks to a level acceptable to the institution head;
(C) ensure that information security is
				  addressed throughout the lifecycle of institution of higher education
				  information resources; and
(D)
				  ensure compliance with:
(i) the requirements
				  of 1 Texas Administrative Code Chapter 202 Subchapter C;
(ii) minimally acceptable system
				  configuration requirements, as determined by the institution of higher
				  education; and
(iii) the control
				  catalog published by the department.
(3) strategies to address risk to high impact
				  information resources;
(4) plans
				  for providing information security for networks, facilities, and systems or
				  groups of information systems and applications based on risk;
(5) a process for planning, implementing,
				  evaluating, and documenting remedial action to address any deficiencies in the
				  information security policies, procedures, and practices of the institution of
				  higher education; and
(6) a process
				  to justify, grant and document any exceptions to specific program requirements
				  in accordance with requirements and processes defined in this
				  chapter.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.75 - Managing Security Risks

Current through Reg. 49, No. 28; July 12, 2024
A risk assessment of the institution's information,
					 information systems, and applications shall be performed and documented.
(1) Risks and impact impacts will be ranked,
				  at a minimum, as either "High," "Moderate," or "Low."
(2) The schedule of the future risk
				  assessments will be documented.
(3)
				  Risk assessment results, vulnerability reports, and similar information shall
				  be documented and presented to the Information Security Officer or their
				  designated representative(s).
(4)
				  Approval of the security risk acceptance, transference, or mitigation decisions
				  shall be the responsibility of:
(A) the
				  Information Security Officer or their designee(s), in coordination with the
				  information owner, for systems identified with Low or Moderate residual
				  risk.
(B) The institution of higher
				  education head for all systems identified with a High residual risk.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.76 - Security Control Standards Catalog

Current through Reg. 49, No. 28; July 12, 2024
(a)
				  Mandatory Requirements. Mandatory security controls shall be defined by the
				  department in a Control Standards document published on the department's
				  website.
(b) Minimum Requirements
				  for Security Controls. The controls required by subsection (a) of this section
				  shall include:
(1) minimum information
				  security requirements for all institution information, information systems, and
				  applications; and
(2) standards to
				  be used by all institutions of higher education to provide levels of
				  information security according to risk categorizations.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter C - INFORMATION SECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION › Section 202.77 - Texas Risk and Authorization Management Program for Institutions of Higher Education

Current through Reg. 49, No. 28; July 12, 2024
An institution of higher education contracting for cloud
					 computing services that store, process, or transmit data of the institution of
					 higher education shall:
(1) confirm
				  that vendors contracting with the institution of higher education to provide
				  cloud computing services for the institution of higher education are certified
				  through TX-RAMP prior to entering or renewing a cloud computing services
				  contract on or after January 1, 2022; and
(2) require a vendor contracting with the
				  institution of higher education to provide cloud computing services for the
				  institution of higher education that are subject to the state risk and
				  authorization management program to maintain program compliance and
				  certification throughout the term of the contract.
Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 203 - MANAGEMENT OF ELECTRONIC TRANSACTIONS AND SIGNED RECORDS › Subchapter A - DEFINITIONS › Section 203.1 - Applicable Terms and Technologies for Management of Electronic Transactions and Signed Records

Current through Reg. 49, No. 28; July 12, 2024
The following words and terms, when used in this chapter,
					 shall have the following meanings, unless the context clearly indicates
					 otherwise.
(1) Asymmetric
				  cryptosystem--A computer-based system that employs two different but
				  mathematically related keys with the following characteristics:
(A) one key encrypts a given
				  message;
(B) one key decrypts a
				  given message; and
(C) the keys
				  have the property that, knowing one key, it is computationally infeasible to
				  discover the other key.