SECTION 202.73. Security Reporting

(a) Each Information Security Officer shall directly report to the agency head, at least annually, on the adequacy and effectiveness of information security policies, procedures, practices, compliance with the requirements of this chapter, and:

(1) effectiveness of current information security program and status of key initiatives;

(2) residual risks identified by the institution of higher education risk management process; and

(3) institution of higher education information security requirements and requests.

(b) Each institution of higher education shall submit to the department a Biennial Information Security Plan in accordance with Texas Government Code §2054.133.

(c) At least every two years, each institution of higher education shall complete and submit an information security assessment in compliance with the requirements of Texas Government Code §2054.515 and this subsection.

(1) The institution of higher education's Biennial Information Security Plan may be considered to satisfy the information security assessment requirements of Texas Government Code §2054.515(a)(1) if the institution's Biennial Information Security Plan assesses:

(A) The security of the institution's information resources systems, network systems, and digital data storage systems;

(B) The measures in place to establish digital data security; and

(C) The vulnerabilities of the institution's information resources, including an evaluation determining how well the organization's security policies protect its data and information systems.

(2) To comply with Texas Government Code §2054.515(a)(2), an institution of higher education must complete a data maturity assessment in alignment with the requirements established at 1 Texas Administrative Code §218.10.

(3) Upon completion of its information security assessment, an institution of higher education shall report the results of its assessment to the department in the form and manner identified by the department. An institution of higher education must comply with a request for the results of its assessment received from the Office of the Governor, Lieutenant Governor, or speaker of the House of Representatives.

(d) Each state institution of higher education shall assess the significance of a security incident based on the business impact on the affected resources and the current and potential technical effect of the incident (e.g., loss of revenue, productivity, access to services, reputation, unauthorized disclosure of confidential information, or propagation to other networks). Confirmed or suspected incidents shall be reported to immediate supervisors and the institution of higher education Information Security Officer.

(1) An institution of higher education shall report security incidents to the department within 48 hours of discovery in the form and manner specified by the department where the security incident is assessed to:

(A) propagate to other state systems;

(B) result in criminal violations that shall be reported to law enforcement in accordance with state or federal information security or privacy laws;

(C) involve the unauthorized disclosure or modification of confidential information, e.g., sensitive personal information as defined in Texas Business and Commerce Code §521.002(a)(2) and other applicable laws that may require public notification; or

(D) be an unauthorized incident that compromises, destroys, or alters information systems, applications, or access to such systems or applications in any way.

(2) If the security incident is assessed to involve suspected criminal activity (e.g., violations of Texas Penal Code Chapters 33 or 33A), the institution of higher education shall contact law enforcement, as required, and the security incident shall be investigated, reported, and documented in accordance with the legal requirements for handling of evidence.

(3) Depending on the nature of the incident, it will not always be feasible to gather all the information prior to reporting. In such cases, incident response teams shall continue to report information to the department as it is collected. The department shall instruct state institutions of higher education as to the manner in which they shall report such information to the department. Supporting vendors or other third parties that report security incident information to an institution of higher education shall submit such reports to the institution of higher education in the form and manner specified by the department, unless otherwise directed by the institution of higher education. Institutions of higher education shall ensure that compliant reporting requirements are included in any contract where incident reporting may be necessary.

(4) Ten days after the date of the eradication, closure, and recovery from a security incident, an institution of higher education shall notify the department and the chief information security officer in the form and manner prescribed by the department of the security incident details and an analysis of the security incident cause.

Source Note: The provisions of this §202.73 adopted to be effective March 17, 2015, 40 TexReg 1357; amended to be effective March 16, 2016, 41 TexReg 1831; amended to be effective November 17, 2021, 46 TexReg 7775; amended to be effective November 16, 2023, 48 TexReg 6579