Texas Administrative Code › Title 1 - ADMINISTRATION › Part 10 - DEPARTMENT OF INFORMATION RESOURCES › Chapter 202 - INFORMATION SECURITY STANDARDS › Subchapter A - DEFINITIONS AND RESPONSIBILITIES › Section 202.1 - Applicable Terms and Technologies for Information Security Standards

Current through Reg. 49, No. 28; July 12, 2024
The following words and terms, when used in this chapter,
					 shall have the following meanings, unless the context clearly indicates
					 otherwise.
(1) Access--The physical or
				  logical capability to view, interact with, or otherwise make use of information
				  resources.
(2) Agency Head--The
				  top-most senior executive with operational accountability for an agency,
				  department, commission, board, office, council, authority, or other agency in
				  the executive or judicial branch of state government, that is created by the
				  constitution or a statute of the state; or institutions of higher education, as
				  defined in Texas Education Code §
										61.003.
(3) Application--As defined in Texas
				  Government Code §
										2054.003(1).
(4) Availability--The security objective of
				  ensuring timely and reliable access to and use of information.
(5) Cloud Computing--Has the same meaning as
				  "Advanced Internet-Based Computing Service" as defined in Texas Government Code
				  §
										2157.007(a).
(6) Cloud Computing Service--The meaning
				  assigned by Special Publication 800-145 issued by the United States Department
				  of Commerce National Institute of Standards and Technology as the definition
				  existed on January 1, 2015.
(7)
				  Confidential Information--Information that must be protected from unauthorized
				  disclosure or public release based on state or federal law or other legal
				  agreement.
(8) Confidentiality--The
				  security objective of preserving authorized restrictions on information access
				  and disclosure, including means for protecting personal privacy and proprietary
				  information.
(9) Control--A
				  safeguard or countermeasure, including devices, policies, procedures,
				  techniques, or other measures, that are prescribed to meet security
				  requirements of an information system or organization to preserve. Controls may
				  include security features, management constraints, personnel security, and
				  security of physical structures, areas, and devices.
(10) Control Standards Catalog--The document
				  that provides state agencies and higher education institutions state specific
				  implementation guidance for alignment with the National Institute of Standards
				  and Technology (NIST) SP (Special Publication) 800-53 security
				  controls.
(11) Custodian--See
				  information custodian.
(12)
				  Department--The Department of Information Resources.
(13) Destruction--The result of actions taken
				  to ensure that physical and digital media cannot be reused as originally
				  intended and that information is technologically infeasible or prohibitively
				  expensive to recover.
(14)
				  Electronic Communication--A process used to convey a message or exchange
				  information via electronic media. It includes the use of electronic mail
				  (email), Internet access, Instant Messaging (IM), Short Message Service (SMS),
				  facsimile transmission, and other paperless means of communication.
(15) Encryption (encrypt or encipher)--The
				  conversion of plaintext information into a code or cipher text using a variable
				  called a "key" and processing those items through a fixed algorithm to create
				  the encrypted text that conceals the data's original meaning.
(16) FedRAMP--Federal Risk and Authorization
				  Management Program.
(17)
				  Guideline--Recommended, non-mandatory controls that help support standards or
				  serve as a reference when no applicable standard is in place.
(18) High Impact Information
				  Resources--Information Resources whose loss of confidentiality, integrity, or
				  availability could be expected to have a severe or catastrophic adverse effect
				  on organizational operations, organizational assets, or individuals. Such an
				  event could:
(A) cause a severe degradation in
				  or loss of mission capability to an extent and duration that the organization
				  is not able to perform one or more of its primary functions;
(B) result in major damage to organizational
				  assets;
(C) result in major
				  financial loss; or
(D) result in
				  severe or catastrophic harm to individuals involving loss of life or serious
				  life-threatening injuries.