We released today a series of administrative changes to the security control standards. The majority of these changes moved TAMUS Implementation Statement language into organizationally-defined parameters (ODP) within each control, as well as implementing control standards that reflect existing system policy and assigning an impact baseline for all TAMUS-required controls.

The changes to controls include:

• AC-2(7): Implementation language moved to AT-3
• AC-8: Withdrawn TAMUS implementation language
• AT-2: Added ODP for frequency of training
• AT-2(2): Implemented insider threat training as part of the system delivered Information Security Awareness (3001) course
• AT-2(3): Implemented social engineering and mining training as part of the system delivered Information Security Awareness (3001) course
• AT-3: Implemented language moved from AC-2(7) for privileged user role-based training
• AT-4: Implemented language to address recordkeeping of training delivered via TrainTraq
• CA-2: Added ODP for frequency of control assessments
• CA-2(1): Implemented language from 1 TAC 202
• CM-6: Eliminated language referring to major information systems, relying solely on high-impact systems
• CP-4: Moved TAMUS implementation language into ODP
• IA-2(1): Removed TAMUS implementation statement in lieu of DIR having a higher implementation burden
• IA-5(9): Moved TAMUS implementation language into ODP
• IR-4: Added references from 29.01.03 to TAMUS implementation statement
• IR-4(1): Added ODP for automated incident handling process using TAMUS Cyber provided toolsets
• IR-4(8): Added ODP with references from 29.01.03
• IR-4(14): Added references from 29.01.03 to TAMUS implementation statement
• IR-6: Moved TAMUS implementation language into ODP
• IR-6(1): Added ODP with references from 29.01.03
• PL-4: Added ODP for frequency of reviewing rules of behavior
• PL-10: Implemented language to define the control baseline for A&M System information resources
• PM-5: Added ODP for frequency of updating inventories of information systems
• PT-3: Moved to SI-12(1)
• RA-3: Added ODP with references from 29.01.03
• RA-5(11): Added ODP to designate TAMUS Cyber Operations as central point of contact for public vulnerability disclosures, inheriting authority from 29.01.03
• SI-5(1): Added ODP for automated reporting with references from 29.01.03
• SI-12(1): Implemented control moved from PT-3
• SR-6: Implemented language designating TAMUS Cyber as provider of supplier assessments and reviews

An updated Covered Applications and Prohibited Technology Plan, as required by Texas DIR and Texas DPS, was issued today. The updated plan incorporates the requirements of Texas Government Code Chapter 620 and revises the plan's language throughout.

The revised plan is available at https://cyber.tamus.edu/policy/guidelines/prohibited-technology/.

A revised System Regulation 29.01.03, Information Security, was released today. This revision:

• adds or clarifies language to reflect the reorganization of the Security Operations Center (SOC) to Texas A&M University System Cybersecurity,
• clarifies the purpose of the Texas A&M System Security Control Standards Catalog and eliminates duplicative or redundant reference to the Texas DIR Security Control Standards Catalog,
• adds supporting language that references system requirements to Texas statute or administrative rule,
• establishes a required frequency for performing risk assessments based on the impact of the system being assessed,
• moves detailed guidance for data center consolidation to the A&M System Security Control Standards Catalog, and
• eliminates guidance for member CIO approval of commodity IT services

The revised regulation is available at https://policies.tamus.edu/29-01-03.pdf.

The comment period for new security control standards regarding Identity Proofing (IA-12(2)) and Identity Evidence Validation and Verification (IA-12(3)) has closed and the new standards have been published in the A&M System Security Control Standards Catalog.

Because this is a time-sensitive procedural implementation to address actively-exploited cyber risks, the implementation date is effective September 1.

When developing your member-level procedures to implement this control standard, please also take into consideration distributed systems with user accounts for which organizations other than IT may be responsible (this includes HR for TAMUS SSO accounts, Provost/Enrollment Management/Alumni Affairs for prospective students, alumni, etc.) and ensure those administrators are properly briefed on the control requirement.

We have made slight modifications to the incident reporting process within the TAMUS ISAO Portal. Please see the updated instructions here: https://cyber.tamus.edu/policy/guidelines/incident-notification/submit-incident/

These changes simplify the steps necessary for members to submit incident reports, eliminates extraneous actions on the back-end for TAMUS Cyber, and allows for TAMUS Cyber to communicate back-and-forth with the reporting member directly within the TAMUS ISAO Portal.

Welcome to the Cybersecurity blog!

We will post any updates, changes, answers to questions, etc. regarding the A&M System's cybersecurity policy program here.

Related posts include System Regulation 29.01.03 (and other regulations that may have security implications), the security control standards catalog, their supporting guidelines, as well as useful information regarding the implementation of the standards.

Stay tuned!