Texas Administrative Code Ch. 202

Texas Administrative Code Ch. 202WEDNESDAY, JULY 23, 2014 AUSTIN, TEXAS

TAC 202 Historical PerspectivePrevious to TAC 202, TAC 201.13 defined state security standardsTAC 202 was originally proposed, drafted and published between2002 and 2003Amended to include Higher Education Subchapter in November2004Amended to address wireless technology in April 2006Amended to address firewalls, encryption and incidentmanagement in September 2009Amended to address encryption standards in June 2012Subject to review every 4 years with no substantial changes since2004

Technology in the New Millennium2001 – Wikipedia and the iPod were launched2003 – Apple’s iTunes debut2003 – SQL Slammer Worm affected over 75K hosts within 10 min.2004 – Google IPO and the first 1 gigabyte SD Card was released2004 – T-Mobile had a Christmas launch of 3G mobile data service2004 – Broadband Internet access outpaced dial-up for the first time2004 – Facebook is launched2005 – USB flash drives replaced floppy disks2005 – YouTube is launched2006 – Twitter is launched

Pros of current TAC 202PROSSets a standard for the entire stateEstablishes a baseline of minimum securityOrganized to address differences between Higher Education andState AgenciesAs a rule, it is stronger than a policy

Cons of current TAC 202CONSEasy to read structure makes defining technical requirementsdifficultAs a rule as opposed to policy it is more cumbersome to modifySections make consistency difficult when defining controls –creates interpretation gapsStructure blends people, process and technology roles that cancreate confusion and complexityMinimum security baseline has been eclipsed by increased riskand threats, as well as external requirements

Drivers for ChangeDoesn’t address newer technologiesAddresses some organizational controls, But places business functions within IT (Business Continuity Planning, RiskAcceptance)Lacks many managerial controls (Process)Overly vague in many technical controls(Technology)Technical controls do not consider evolvedtechnology Cloud, Mobile, Social MediaInformation SecurityProgram

TAC 202 TimelineBoardApprovesRule ReviewAug-2013Jul-2013RFOpublishedSep-2013Control Catalog/Crosswalkfrom VendorStrawman Ruleto SISAC PolicySubcommitteeFeb-2014Mar-2014Draft Security ControlStandards/Crosswalk to SISACPolicy SubcommitteeDraft RuleSubmittedto ITCHEJul-2014Approved RulePublished inTexas RegisterNov-2014Oct-2014Draft Rulesubmitted to DIRBoard for ApprovalFeb-2015Draft rulesubmitted to DIRBoard for AdoptionMilestones July: Draft rule and Security Control Standards submitted to ITCHE for reviewand comment October: Draft rule and Security Control Standards submitted to the DIR board February 2015: Earliest possible adoption of new rule

SISAC Policy Sub-committee MembershipMemberOrganizationRepresentsKen PalmquistDIRArticle 1 (General Government)Ed TjarksTexas Comptroller of Public AccountsArticle 1 (General Government)Khatija SyedaHealth and HumanArticle 2 (Health & Human Services)Fred LawsonHealth and HumanArticle 2 (Health & Human Services)Darrell BatemanTexas Tech UniversityArticle 3 (Education)Jeff McCabeTexas A&MArticle 3 (Education)Danny MillerTexas A&MArticle 3 (Education)John SkaarupTexas Education AgencyArticle 3 (Education)Jana ChvatalUniversity of HoustonArticle 3 (Education)Miguel SoldiUniversity of Texas SystemArticle 3 (Education)Richard MorseOffice of Court AdministrationArticle 4 (Judiciary)Alan FerrettiTexas Department of Public SafetyArticle 5 (Public Safety & Criminal Justice)Miguel ScottTexas Department of Public SafetyArticle 5 (Public Safety & Criminal Justice)Angela GowerTexas Department of AgricultureArticle 6 (Natural Resources)Joshua KuntzDepartment of Motor VehiclesArticle 7 (Business and Economic Development)Clarence CampbellTexas Department of Licensing and Regulation Article 8 (Regulatory)Chad LerschDIRGeneral CounselLon BernquistDIRPolicyChristian ByrnesGartnerPrivate SectorMike WyattDeloittePrivate Sector

SISAC Policy Subcommittee ProcessMonthly meeting moved to bi-monthlyFacilitated discussion, review and revision processSpirited debates with consensus resultsBroad representation provided critical insightsMany thanks to the contributions and efforts of the groupProvides a great forum for the ongoing review and revisionsneeded to continue to approach touch issues

Legacy TACLegacy TAC 202Applicable Terms andTechnologies forInformation SecurityInstitution of HigherEducationState AgencyManagement and StaffResponsibilitiesSecurity IncidentsSecurity Standards PolicyManaging Security RisksManaging Physical SecurityBusiness ContinuityPlanningInformation ResourcesSecurity SafeguardsUser Security PracticesRemoval of Data from DataProcessing EquipmentControls integrated into therule itselfRoles and responsibilitiesare intermingled withtechnical detailsRequirements are definedbut not clearly specified

FISMAFISMAFocused on roles andresponsibilitiesControls areincorporated throughNIST SP 800-53Enables controls tobe more nimbleInformation SecurityPurposesDefinitionsAuthority and functions ofthe DirectorFederal agencyresponsibilitiesFederal informationsecurity incident centerNational security systemsAuthorization ofappropriationsEffect on existing lawFour updates since2005NIST SP 800-53

Revisions to Federal rulesFISMASP 800-53 Passed in 2002 Rev 1: Feb 2005 Amended in 2014 Rev 2: Dec 2007 Rev 3: Aug 2009 Rev 4: Apr 2013

Moving TAC toward FISMALegacy TAC 202Revised TAC 202FISMAApplicable Terms andTechnologies forInformation SecurityDefinitionsInformation SecurityInstitution of HigherEducationInstitution of HigherEducationPurposesState AgencyState AgencyDefinitionsManagement and StaffResponsibilitiesResponsibilities of the StateCISOAuthority and functions ofthe DirectorSecurity IncidentsResponsibilities of theAgency HeadFederal agencyresponsibilitiesSecurity Standards PolicyResponsibilities of theAgency ISOFederal informationsecurity incident centerManaging Security RisksStaff ResponsibilitiesNational security systemsManaging Physical SecuritySecurity ReportingAuthorization ofappropriationsBusiness ContinuityPlanningAgency Security PolicyEffect on existing lawControl CatalogNIST SP800-53Information ResourcesSecurity SafeguardsUser Security PracticesRemoval of Data from DataProcessing Equipment

Texas Administrative Code § 202DefinitionsInstitution of Higher EducationState AgencyResponsibilities of the State’s Chief Information Security OfficerResponsibilities of the Agency HeadResponsibilities of the Information Security OfficerStaff ResponsibilitiesSecurity ReportingAgency Information Security ProgramManaging Security RisksSecurity Control Standards

Security Control StandardsGroup IDUses NIST SP80053 nomenclatureProvides controlinformationDeveloped toprovide for a state,agency, anddepartmentalimplementationGroup TitleControl IDControl TitleRisk StatementPriority /BaselineRequired DateControlDescriptionImplementation[NIST Domain Name abbreviation, e.g. ‘AC’ for Access Control, ‘AT’ forAwareness and Training, etc ][Unabbreviated NIST control family description, e.g. ‘Access Control’][NIST 800-53 Rev. 4 Control (MOD) control number in sequence asapplicable, e.g. ‘AC-1’][NIST 800-53 Rev. 4 Control (MOD) control name, e.g. ‘Access Control Policyand Procedures’][A high level statement of the potential risk present by not addressing thecontrol activity]P1MOD – YesHIGH – Yes[Date which requirement will become effective. Note: Only “Low” baselinecontrols are mandatory for all systems. Other controls may be applicablebased on the state organization risk assessment][Detailed NIST 800-53 Rev. 4 Control (MOD) control leLOW – No[The State level requirements for the implementation ofinformation security controls][To be determined for each state organization; To includeorganization specific components as applicable, e.g. if anorganization has a specific mapping requirement under theHealth Insurance Portability and Accountability Act (HIPAA;or other applicable regulatory driver) this relative controlcould be included here][To be determined for each state organization; To includeorganization specific compartment or divisional levelcomponents as applicable, e.g. if an organization’sdepartment has a specific requirement under HIPAA, as anexample, this relative control could be included here][This section includes example only considerations of how the controlidentified above may be applicable in a state organization securityenvironment]

Comprehensive CrosswalkTexas Cybersecurity Framework(CIPA)TAC202The Children’s Online Privacy Protection Ruleof 2000 (COPPA)NIST 800-53 Rev. 4NIST Cybersecurity Framework (EO 13636)COBITSANS 'Twenty Critical' ControlsIRS Publication 1075CJIS Security PolicyHIPAA SecurityFERPAPrivacy Act of 1974Computer Fraud and Abuse Act of 1986Gramm-Leach-Bliley Act of 1999 (GLBA)Computer Security Act of 1987PCI DSS v2.0The Children’s Internet Protection Act of 2000TX Business and Commerce Code, Ch. 503TX Business and Commerce Code, Ch. 521Texas Government Code, Chapter 2054(Information Resources)Texas Health and Safety Code, Chapter 181(Medical Records Privacy)Texas Health and Safety Code, Chapter 611(Mental Health Records)Texas Government Code Chapter 552(Public Information)Texas Occupations Code, Chapter 159(Physician-Patient Communication)Texas Penal Code, Title 7, Chapter 33(Computer Crimes)

Security Control StandardsGroup IDUses NIST SP80053 nomenclatureProvides controlinformationDeveloped toprovide for a state,agency, anddepartmentalimplementationGroup TitleControl IDControl TitleRisk StatementPriority /BaselineRequired DateControlDescriptionImplementation[NIST Domain Name abbreviation, e.g. ‘AC’ for Access Control, ‘AT’ forAwareness and Training, etc ][Unabbreviated NIST control family description, e.g. ‘Access Control’][NIST 800-53 Rev. 4 Control (MOD) control number in sequence asapplicable, e.g. ‘AC-1’][NIST 800-53 Rev. 4 Control (MOD) control name, e.g. ‘Access Control Policyand Procedures’][A high level statement of the potential risk present by not addressing thecontrol activity]P1MOD – YesHIGH – Yes[Date which requirement will become effective. Note: Only “Low” baselinecontrols are mandatory for all systems. Other controls may be applicablebased on the state organization risk assessment][Detailed NIST 800-53 Rev. 4 Control (MOD) control leLOW – No[The State level requirements for the implementation ofinformation security controls][To be determined for each state organization; To includeorganization specific components as applicable, e.g. if anorganization has a specific mapping requirement under theHealth Insurance Portability and Accountability Act (HIPAA;or other applicable regulatory driver) this relative controlcould be included here][To be determined for each state organization; To includeorganization specific compartment or divisional levelcomponents as applicable, e.g. if an organization’sdepartment has a specific requirement under HIPAA, as anexample, this relative control could be included here][This section includes example only considerations of how the controlidentified above may be applicable in a state organization securityenvironment]

Baselines v. PrioritiesBaselines are used to select which controls toimplement Relate to the Impact of a system Three Impact levels: Low, Moderate, HighPriorities are useful for sequencing controlimplementation Ensures that more fundamental controls are implemented first Four Priorities: P1, P2, P3, P0