![](https://www.saltycloud.com/wp-content/uploads/2023/03/Cyber-Resilience-in-Higher-Education.png)
If you’re a state agency or higher education institution operating in Texas, then you’ve probably heard of TAC 202. But what exactly is TAC 202, and why is it important?
Put simply, TAC 202 establishes information security standards to protect sensitive data and maintain public trust. Organizations that fail to comply with TAC 202 could experience data breaches, unauthorized access, or misuse of sensitive information, all of which could have dire consequences.
This guide from SaltyCloud covers everything you need to know about TAC 202, including what it entails, why it’s important, and how you can comply. We even included a TAC 202 checklist to make it easy for your organization to get started.
Chapter 202 of the Texas Administrative Code (TAC 202) is an information security standard and requirement for Texas state agencies and higher education institutions that establishes minimum standards to protect sensitive data, maintain the confidentiality, integrity, and availability of information resources, and effectively manage risks
TAC 202 covers a wide range of information security topics, including:
This regulation applies to state agencies and higher education institutions in the State of Texas, as well as third-party service providers and contractors that work with these organizations and handle their data.
TAC 202 applies to all data managed by state agencies and institutions of higher education in Texas, including confidential information, personal identifying information (PII) as defined by the Texas Business and Commerce Code § 521.002(a)(1), sensitive personal information as defined by the Texas Business and Commerce Code § 521.002(a)(2), agency sensitive data, public data, nonconfidential information, and state-controlled data.
Although the law does not explicitly prescribe which data types must meet specific controls, it is generally understood that systems handling confidential data should implement at least a moderate baseline of security controls. Non-confidential data systems may start with lower baselines and work towards higher baselines over time.
Certain data types may also be subject to other regulations requiring adherence to specific control baselines in addition to TAC 202. For example, Federal Tax Information (FTI) and Criminal Justice Information Services (CJIS) data, which are designated as Controlled Unclassified Information (CUI), must comply with NIST 800-171 controls.
The Secure Controls Standard Catalog outlines the minimum controls that must be implemented across all Texas state agencies and higher education institutions, regardless of data classification. However, organizations should assess their data and systems to determine the appropriate level of protection required and implement additional controls as necessary.
Getting started with TAC 202 might seem overwhelming. Fortunately, we put together this TAC 202 checklist to help you get started and stay accountable.
Establishing a comprehensive information security program is a critical requirement for Texas state agencies and higher education institutions under TAC 202. The program should protect your organization’s information assets’ confidentiality, integrity, and availability.
Key components of an effective information security program include:
Make sure that dedicated, qualified personnel can oversee and align information security practices with organizational goals and executive oversight.
Designate an Information Security Officer (ISO) or Chief Information Security Officer (CISO) with:
Make sure the ISO reports directly to executive-level management to:
Review and approve the information security program annually by:
Protect your organization’s information resources against threats.
Create, document, and implement an organization-wide information security program that:
Include risk-based protections for all information and resources owned, leased, or under your organization’s custodianship, including those managed by third parties, by:
Establish policies, controls, standards, and procedures based on risk assessments and the Security Control Standards Catalog, ensuring they:
Ensure your information security program aligns with TAC 202 requirements and your organization’s specific information security risks, aiming to:
Proactively identify and mitigate potential threats to critical information resources to ensure your organization’s security posture is resilient and adaptive.
Develop strategies to address risk for high-impact information resources by:
Create risk-based plans for securing information systems and applications that:
Ensure your information security program remains effective and responsive to new challenges and changes in the security landscape.
Establish remediation processes for deficiencies and granting exceptions by:
Regularly review and update your information security program to:
Understand and manage the threats to your organization’s information assets and systems through an information security risk management (ISRM) program
Conduct and document risk assessments of information and information systems by:
Agencies and institutions have several options for conducting information security risk assessments, including external consultants or other internal auditing methods like interviews. However, self-assessment questionnaires (SAQs), also called control self-assessment (CSA), security questionnaires, or security assessment questionnaires, are a risk assessment tool that private and public organizations and their security teams use to assess a given target’s adherence to information security standards, controls, best practices, security policies, and regulatory requirements.
A GRC Assessment Platform like Isora makes it easy for information security & assurance teams to conduct and manage assessments across multiple units, assets, applications, or third-party vendors at scale using the prebuilt Texas Controls Catalog questionnaire.
Information security risk assessment management on Isora GRC
Rank risks and impacts and communicate results to the ISO to:
Align your organization’s approach to handling risks with its risk tolerance decisions and ensure they are made at the correct level of authority.
Get approval for risk management decisions by:
Document and justify risk treatment decisions, including:
Make sure that investments in security are strategically directed toward mitigating the most significant risks and protecting critical assets.
Allocate resources for ongoing information security activities based on risk management decisions by:
Regularly review and adjust resource allocation based on:
Set clear expectations about who will be responsible for what components of your information security program.
This is the highest-ranking executive in your organization who is responsible for overall strategic direction and decision-making. They should:
This senior-level employee is responsible for developing, implementing, and overseeing your organization’s information security program. They should:
These individuals or departments are responsible for creating, managing, and securing specific sets of information assets. They should:
These are individuals or entities responsible for maintaining and securing information systems and assets on behalf of the information owner. They should:
These individuals access and use your organization’s information resources to perform their job duties. They should:
The Texas DIR provides a comprehensive set of mandatory controls in the Security Control Standards Catalog, based on NIST SP 800-53 Rev. 5, that state agencies and higher education institutions must implement to protect their information systems and data.
Here are the key points to consider when implementing and managing security controls:
Implement all mandatory controls as defined in the catalog for all state agency and higher education information systems, starting with low baseline controls and maturing over time to moderate and high baselines.
Apply additional controls or control baselines based on the system’s risk assessment and data classification, especially for systems handling confidential or sensitive information.
Utilize the standards in the catalog to establish risk-based levels of information security, offering guidance on minimum requirements and risk-based controls for different types of data.
Prepare for biennial reviews of the information security program to ensure compliance with the Security Control Standards Catalog, conducted by individuals independent of the program.
Employ more stringent standards to address unique security requirements, ensuring they meet or exceed DIR standards and align with applicable laws, policies, and guidelines. Agencies and institutions can implement additional controls based on their specific needs and risk assessments.
Regularly monitor and assess the effectiveness of implemented security controls, updating them as needed to address changes in the system, risk environment, or legal and regulatory landscape.
Effective information security training and awareness programs ensure all personnel understand their roles and responsibilities in protecting your organization’s information assets. By providing regular training and promoting a culture of information security, state agencies and higher education institutions can reduce the risk of human error, increase compliance with security policies, and foster a more resilient security posture.
Empower users with the knowledge to protect sensitive data and effectively adhere to your organization’s security policies and procedures.
Implement an ongoing information security awareness education program for all users, ensuring the program:
Ensure all new hires are immediately equipped with the knowledge and understanding necessary to protect organizational assets and adhere to security protocols.
Include information security training as a mandatory part of new employee onboarding, covering:
Ensure new employees complete the training before accessing sensitive systems or data, and:
Provide new employees with your organization’s security policies and procedures, and require them to:
Assign a mentor or point of contact within the information security team to:
Ensure those with access to sensitive systems and data are thoroughly trained on advanced security concepts and the responsibilities of their roles.
Identify personnel with elevated privileges (e.g., system administrators, network engineers, security analysts, etc.) and:
Ensure that role-based training is delivered by qualified instructors with relevant expertise and experience and:
Regularly update and refresh role-based training content to:
State agencies and higher education institutions increasingly rely on third-party service providers, including cloud computing services, to support their operations and deliver services to constituents. While these relationships can provide significant benefits, they also introduce new security risks that must be carefully managed.
Organizations should implement a robust third-party security risk management (TPSRM) program that mitigates these risks. This program should include specific requirements for cloud service providers, such as TX-RAMP certification and ongoing compliance monitoring.
A comprehensive TPSRM program should include the following key components:
Only engage with providers that meet Texas’ stringent security standards for cloud services.
Confirm the TX-RAMP certification of cloud service providers before entering or renewing contracts, as mandated for state agencies and higher education institutions.
Integrate TX-RAMP certifications into the vendor selection and contracting processes as part of your TPSRM program.
Document the TX-RAMP certification status of cloud service providers in your organization’s inventory of third-party relationships.
Consider TX-RAMP certification as a critical factor in third-party security risk assessments for cloud service providers.
Make sure cloud providers continuously adhere to Texas’ security standards to protect sensitive data over the duration of your engagement.
Require cloud service providers to maintain TX-RAMP compliance throughout the contract term.
Incorporate processes within the TPSRM program for regularly monitoring and verifying ongoing TX-RAMP compliance of cloud service providers, including:
Update the inventory of third-party relationships as part of the TPSRM program to reflect any changes in cloud service providers’ TX-RAMP compliance status.
Address any non-compliance issues identified through ongoing monitoring promptly through the TPSRM program’s risk management and vendor management processes, which may involve:
The survey experience for external third-party vendor contacts on Isora.
Effective incident response and reporting procedures are critical for minimizing the impact of security incidents and ensuring that state agencies and higher education institutions can quickly detect, investigate, and recover from cyber attacks or data breaches. TAC 202 requires organizations to establish formal incident response plans and reporting processes to ensure a consistent and coordinated approach to incident management.
Ensure your organization is prepared to detect, respond to, and recover from security incidents effectively.
Develop a written incident response plan that acts as a roadmap for:
Ensure the incident response plan aligns with your organization’s business continuity and disaster recovery strategies and:
Include key components in the incident response plan, such as:
Systematically assess security incidents based on their impact and severity, ensuring an appropriate response.
Establish clear criteria for classifying and prioritizing security incidents based on potential impact and severity, including:
Prioritize incidents based on their classification and the urgency of the response required to:
Ensure significant security incidents are promptly reported to the DIR and other relevant entities to facilitate a coordinated response and comply with legal obligations.
Promptly report significant security incidents to the DIR and other relevant authorities, in accordance with TAC 202 and applicable laws or regulations, including incidents that:
Report incidents to DIR within 48 hours of discovery using the prescribed notification format, including:
Notify other stakeholders as required, such as:
State agencies and higher education institutions are responsible for maintaining compliance with TAC 202 and other applicable laws and regulations. Regular reporting and communication with oversight bodies and stakeholders are essential for demonstrating the effectiveness of the organization’s information security program and identifying areas for improvement.
Enable your ISO to communicate the effectiveness of your information security program and compliance efforts to leadership.
The ISO must report annually to the agency or institution head on:
The annual report should include:
Ensure the annual report is presented to the agency or institution head and other senior leaders to:
Provide a forward-looking and strategic document to the DIR that details a roadmap for your information security program in alignment with state and federal regulations.
Submit a Biennial Information Security Plan to the DIR, including:
Develop the plan in collaboration with key stakeholders, such as:
Review and approve the plan by the agency or institution head before submission to DIR, ensuring:
DIR may provide feedback or require additional information to:
Evaluate and report on the robustness of your information security programs and data management practices to DIR.
Complete and submit information security and data maturity assessments to DIR every two years, focusing on:
The information security assessment should include:
The data maturity assessment should review:
Conduct assessments via qualified and objective third-party assessors or internal audit teams and:
DIR may use the assessment results to:
TAC 202 compliance software should contain a range of features and functionalities to simplify, streamline, and automate complying with TAC 202 information security standards for state agencies and higher education institutions.
Ultimately, this software should help your organization manage its information security program effectively and efficiently. The ideal TAC 202 software should include:
Isora is a GRC Assessment Platform that empowers everyone to own risk together with user-friendly and flexible tools. With Isora, teams can stay agile and responsive to growing changes, fostering a resilient organizational culture. Dozens of small and large infosec teams across Texas agencies and institutions of higher education trust Isora to help them manage their TAC 202 compliance efforts and streamline their overall information security risk management (ISRM), application security risk management (ASRM), and third-party security risk management (TPSRM) programs.
Assessment scorecards and reports in Isora GRC
Complying with TAC 202 is a critical responsibility for Texas state agencies and institutions of higher education. It ensures the protection of sensitive data, maintains public trust, and demonstrates a commitment to cybersecurity best practices.
By following the requirements outlined in TAC 202 and implementing a comprehensive information security program, organizations can effectively manage risks, detect and respond to incidents, and foster a culture of security awareness.
To recap, the key elements of a successful TAC 202 compliance strategy include:
State agencies and higher education institutions can leverage specialized TAC 202 compliance software, such as Isora GRC, to streamline and automate many of these compliance activities. These tools provide a centralized platform for managing IT inventories, conducting risk self-assessments, and compliance reporting, enabling organizations to efficiently and effectively meet their TAC 202 obligations.
By staying informed about the evolving regulatory landscape in Texas, adopting a proactive and risk-based approach to information security, and fostering a culture of shared responsibility and continuous improvement, Texas state agencies and institutions of higher education can successfully navigate the challenges of TAC 202 compliance to secure the Lone Star State inside and out.
This guide covers everything you need to know about TAC 202, including what it entails, why it's important, and how you can comply. We even included a TAC 202 checklist to make it easy for your organization to get started.
This Complete Guide explores basics and the compliance checklist for the GLBA Safeguards Rule risk assessment of customer information security programs.
This Complete Guide explores basics and the compliance checklist for the GLBA Safeguards Rule requiring IT security programs securing customer data