Skip to main content

Information Security Controls Matrix

The information security controls matrix identifies security controls required by the State of Texas or Texas A&M University System and assigns responsibility for implementing the control to one of the following:

 (Common) controls are implemented at the Texas A&M System level and are inheritable by each member institution;

 (Hybrid) controls are a shared responsibility between the Texas A&M System and each member institution;

 (Org) controls are implemented by each member at the institution level and inherited by all information systems;

 (Info Sys) controls are the responsibility of each information resource owner under the direction of the member information security officer.

The Provider column indicates the common control provider for Common and Hybrid controls, and the scope of the common control.

ControlCommonHybridOrgInfo SysProvider
AC — Access Control
AC-01 — Policy and Procedures——X——
AC-02 — Account Management——X——
AC-02(03) — Disable Accounts———X—
AC-02(07) — Privileged User Accounts——X——
AC-03 — Access Enforcement———X—
AC-03(07) — Role-based Access Control——X——
AC-05 — Separation of Duties——X——
AC-06 — Least Privilege——X——
AC-07 — Unsuccessful Logon Attempts———X—
AC-08 — System Use Notification——X——
AC-11 — Device Lock———X—
AC-14 — Permitted Actions Without Identification or Authentication——X——
AC-17 — Remote Access——X——
AC-18 — Wireless Access——X——
AC-19 — Access Control for Mobile Devices——X——
AC-20 — Use of External Systems——X——
AC-22 — Publicly Accessible Content——X——
AT — Awareness and Training
AT-01 — Policy and Procedures——X——
AT-02 — Literacy Training and AwarenessX———TAMUS Cybersecurity
AT-02(02) — Insider ThreatX———TAMUS Cybersecurity
AT-02(03) — Social Engineering and MiningX———TAMUS Cybersecurity
AT-03 — Role-based Training——X——
AT-04 — Training Records—X——TrainTraq (for literacy training records)
AU — Audit and Accountability
AU-01 — Policy and Procedures——X——
AU-02 — Event Logging——X——
AU-03 — Content of Audit Records———X—
AU-04 — Audit Log Storage Capacity——X——
AU-05 — Response to Audit Logging Process Failures———X—
AU-06 — Audit Record Review, Analysis, and Reporting——X——
AU-08 — Time Stamps———X—
AU-09 — Protection of Audit Information———X—
AU-11 — Audit Record Retention——X——
AU-12 — Audit Record Generation———X—
CA — Assessment, Authorization, and Monitoring
CA-01 — Policy and Procedures——X——
CA-02 — Control Assessments——X——
CA-02(01) — Independent Assessors——X——
CA-03 — Information Exchange——X——
CA-05 — Plan of Action and Milestones——X——
CA-06 — Authorization——X——
CA-07 — Continuous Monitoring——X——
CA-07(04) — Risk Monitoring——X——
CA-08 — Penetration Testing——X——
CA-09 — Internal System Connections——X——
CM — Configuration Management
CM-01 — Policy and Procedures——X——
CM-02 — Baseline Configuration——X——
CM-03 — Configuration Change Control——X——
CM-03(02) — Testing, Validation, and Documentation of Changes——X——
CM-04 — Impact Analyses——X——
CM-05 — Access Restrictions for Change——X——
CM-06 — Configuration Settings——X——
CM-07 — Least Functionality——X——
CM-08 — System Component Inventory——X——
CM-10 — Software Usage Restrictions——X——
CM-11 — User-installed Software——X——
CP — Contingency Planning
CP-01 — Policy and Procedures——X——
CP-02 — Contingency Plan——X——
CP-02(01) — Coordinate with Related Plans——X——
CP-03 — Contingency Training——X——
CP-04 — Contingency Plan Testing——X——
CP-04(01) — Coordinate with Related Plans——X——
CP-06 — Alternate Storage Site——X——
CP-07 — Alternate Processing Site——X——
CP-08 — Telecommunications Services——X——
CP-09 — System Backup——X——
CP-09(02) — Test Restoration Using Sampling——X——
CP-09(03) — Separate Storage for Critical Information——X——
CP-10 — System Recovery and Reconstitution——X——
CP-11 — Alternate Communications Protocols——X——
IA — Identification and Authentication
IA-01 — Policy and Procedures——X——
IA-02 — Identification and Authentication (Organizational Users)——X——
IA-02(01) — Multi-factor Authentication to Privileged Accounts———X—
IA-02(02) — Multi-factor Authentication to Non-privileged Accounts———X—
IA-04 — Identifier Management——X——
IA-05 — Authenticator Management——X——
IA-05(01) — Password-based Authentication——X——
IA-05(09) — Federated Credential Management——X——
IA-06 — Authentication Feedback———X—
IA-07 — Cryptographic Module Authentication———X—
IA-08 — Identification and Authentication (Non-organizational Users)———X—
IA-11 — Re-authentication——X——
IA-12 — Identity Proofing——X——
IA-12(02) — Identity Evidence——X——
IA-12(03) — Identity Evidence Validation and Verification——X——
IR — Incident Response
IR-01 — Policy and Procedures——X——
IR-02 — Incident Response Training——X——
IR-03 — Incident Response Testing——X——
IR-04 — Incident HandlingX———TAMUS Cybersecurity
IR-04(08) — Correlation with External Organizations——X——
IR-04(14) — Security Operations CenterX———TAMUS Cybersecurity
IR-05 — Incident Monitoring—X——TAMUS Cybersecurity (for incidents managed by TAMUS Cyber Operations)
IR-06 — Incident Reporting——X——
IR-06(01) — Automated Reporting——X——
IR-07 — Incident Response Assistance——X——
IR-08 — Incident Response Plan——X——
IR-09 — Information Spillage Response——X——
MA — Maintenance
MA-01 — Policy and Procedures——X——
MA-02 — Controlled Maintenance——X——
MA-04 — Nonlocal Maintenance——X——
MA-05 — Maintenance Personnel——X——
MP — Media Protection
MP-01 — Policy and Procedures——X——
MP-02 — Media Access——X——
MP-03 — Media Marking——X——
MP-06 — Media Sanitization——X——
MP-06(01) — Review, Approve, Track, Document, and Verify——X——
MP-07 — Media Use——X——
PE — Physical and Environmental Protection
PE-01 — Policy and Procedures——X——
PE-02 — Physical Access Authorizations——X——
PE-03 — Physical Access Control——X——
PE-06 — Monitoring Physical Access——X——
PE-06(03) — Video Surveillance——X——
PE-08 — Visitor Access Records——X——
PE-12 — Emergency Lighting——X——
PE-13 — Fire Protection——X——
PE-14 — Environmental Controls——X——
PE-15 — Water Damage Protection——X——
PE-16 — Delivery and Removal——X——
PE-17 — Alternate Work Site——X——
PE-18 — Location of System Components——X——
PL — Planning
PL-01 — Policy and Procedures——X——
PL-02 — System Security and Privacy Plans——X——
PL-04 — Rules of Behavior——X——
PL-04(01) — Social Media and External Site/Application Usage Restrictions——X——
PL-10 — Baseline Selection——X——
PL-11 — Baseline Tailoring——X——
PM — Program Management
PM-01 — Information Security Program Plan——X——
PM-02 — Information Security Program Leadership Role——X——
PM-03 — Information Security and Privacy Resources——X——
PM-04 — Plan of Action and Milestones Process——X——
PM-05 — System Inventory——X——
PM-05(01) — Inventory of Personally Identifiable Information——X——
PM-06 — Measures of Performance——X——
PM-07 — Enterprise Architecture——X——
PM-09 — Risk Management Strategy——X——
PM-10 — Authorization Process——X——
PM-11 — Mission and Business Process Definition——X——
PM-14 — Testing, Training, and Monitoring——X——
PM-15 — Security and Privacy Groups and Associations—X——TAMUS Cybersecurity
PM-16 — Threat Awareness Program——X——
PM-22 — Personally Identifiable Information Quality Management——X——
PS — Personnel Security
PS-01 — Policy and Procedures——X——
PS-02 — Position Risk DesignationX———TAMUS and Member Human Resources
PS-03 — Personnel ScreeningX———TAMUS and Member Human Resources
PS-04 — Personnel Termination——X——
PS-05 — Personnel Transfer——X——
PS-06 — Access Agreements——X——
PS-07 — External Personnel Security——X——
PS-08 — Personnel Sanctions——X——
PS-09 — Position DescriptionsX———TAMUS and Member Human Resources
RA — Risk Assessment
RA-01 — Policy and Procedures——X——
RA-02 — Security Categorization——X——
RA-03 — Risk Assessment——X——
RA-03(01) — Supply Chain Risk Assessment——X——
RA-05 — Vulnerability Monitoring and Scanning——X——
RA-05(02) — Update Vulnerabilities to Be Scanned——X——
RA-05(11) — Public Disclosure Program——X——
RA-07 — Risk Response——X——
SA — System and Services Acquisition
SA-01 — Policy and Procedures——X——
SA-02 — Allocation of Resources——X——
SA-03 — System Development Life Cycle——X——
SA-04 — Acquisition Process——X——
SA-05 — System Documentation——X——
SA-08 — Security and Privacy Engineering Principles——X——
SA-09 — External System Services——X——
SA-10 — Developer Configuration Management——X——
SA-11 — Developer Testing and Evaluation——X——
SA-22 — Unsupported System Components——X——
SC — System and Communications Protection
SC-01 — Policy and Procedures——X——
SC-05 — Denial-of-service Protection———X—
SC-07 — Boundary Protection———X—
SC-07(11) — Restrict Incoming Communications Traffic———X—
SC-08 — Transmission Confidentiality and Integrity———X—
SC-12 — Cryptographic Key Establishment and Management——X——
SC-13 — Cryptographic Protection———X—
SC-15 — Collaborative Computing Devices and Applications———X—
SC-20 — Secure Name/Address Resolution Service (Authoritative Source)———X—
SC-21 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)———X—
SC-22 — Architecture and Provisioning for Name/Address Resolution Service———X—
SC-39 — Process Isolation———X—
SI — System and Information Integrity
SI-01 — Policy and Procedures——X——
SI-02 — Flaw Remediation——X——
SI-03 — Malicious Code Protection——X——
SI-04 — System MonitoringX———TAMUS Cybersecurity (for managed endpoints)
SI-05 — Security Alerts, Advisories, and Directives——X——
SI-08 — Spam Protection——X——
SI-10 — Information Input Validation———X—
SI-12 — Information Management and Retention——X——
SI-12(01) — Limit Personally Identifiable Information Elements——X——
SR — Supply Chain Risk Management
SR-01 — Policy and Procedures——X——
SR-02 — Supply Chain Risk Management Plan——X——
SR-03 — Supply Chain Controls and Processes——X——
SR-05 — Acquisition Strategies, Tools, and Methods——X——
SR-08 — Notification Agreements——X——
SR-12 — Component Disposal——X——