Information Systems and Services
BLINN COLLEGE ADMINISTRATIVE REGULATIONS MANUAL
SUBJECT: Information Systems and Services
EFFECTIVE DATE: June 1, 2020; amended September 19, 2023
BOARD POLICY REFERENCE: CS
PURPOSE
Develop policies and procedures for system and services.
PROCESS
System and Services Policy and Procedures (SA-01)
The College District:
- Develops, documents, and disseminates to budget managers:
- A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and
- Reviews and updates the current:
- System and services acquisition policy biennially; and
- System and services acquisition procedures annually.
SYSTEM AND SERVICES POLICY
Allocation of Resources (SA-02)
The College District:
- Determines information security requirements for the information system or information system service in mission/business process planning;
- Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and
- Establishes a discrete line item for information security in organizational programming and budgeting documentation.
System Development Life Cycle (SA-03)
The College District:
- Acquire, develop, and manage the system using a recognized risk mitigation framework that incorporates information security and privacy considerations;
- Define and document information security and privacy roles and responsibilities throughout the system development life cycle;
- Identify individuals having information security and privacy roles and responsibilities; and
- Integrate the organizational information security and privacy risk management process into system development life cycle activities.
Acquisition Process (SA-04)
The College District includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs:
- Security functional requirements;
- Security strength requirements;
- Security and privacy assurance requirements;
- Controls needed to satisfy the security and privacy requirements.
- Security and privacy documentation requirements;
- Requirements for protecting security and privacy documentation;
- Description of the system development environment and environment in which the system is intended to operate;
- Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and
- Acceptance criteria.
Before acquisition, information technology or processing systems receiving, containing or processing personally identifiable information, protected health information or institutional data whether operating on premise or in the cloud must be reviewed and approved by the CISO and legal department.
Information System Documentation (SA-05)
The College District:
- Obtains administrator documentation for the information system, system component, or information system service that describes:
- Secure configuration, installation, and operation of the system, component, or service;
- Effective use and maintenance of security functions/mechanisms; and
- Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;
- Obtains user documentation for the information system, system component, or information system service that describes:
- User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;
- Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and
- User responsibilities in maintaining the security of the system, component, or service;
- Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and is retained by the information system owner in response;
- Protects documentation as required, in accordance with the risk management strategy; and
- Distributes documentation to information system custodians and applicable documentation to users.
Security and Privacy Engineering Principles (SA-08)
Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: NIST 800-37 Rev. 2.
External System Services (SA-09)
The College District:
- Requires providers of external information system services comply with college information security requirements and comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;
- Information system owners are responsible for oversight, defining user roles and responsibilities; and
- Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: TX-RAMP.
Developer Configuration Management (SA-10)
The College District requires the developer of the information system, system component, or information system service to:
- Perform configuration management during system, component, or service design, development, implementation and operation;
- Document, manage, and control the integrity of changes;
- Implement only college-approved changes to the system, component, or service through the change control process;
- Document approved changes to the system, component, or service and the potential security impacts of such changes; and
- Track security flaws and flaw resolution within the system, component, or service and report findings to information system owner and CISO.
Developer Testing and Evaluation (SA-11)
The College District requires the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to:
- Develop and implement a plan for ongoing security and privacy assessments;
- Perform system testing/evaluation;
- Produce evidence of the execution of the assessment plan and the results of the testing and evaluation;
- Implement a verifiable flaw remediation process; and
- Correct flaws identified during testing and evaluation.
Unsupported System Components (SA-22)
- Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
- Provide the support from external providers.