Texas Government Code 2054.133 – Information Security Plan
(a) Each state agency shall develop, and periodically update, an information security plan for protecting the security of the agency’s information.
(b) In developing the plan, the state agency shall:
(1) consider any vulnerability report prepared under § 2054.077 for the agency;
(2) incorporate the network security services provided by the department to the agency under Chapter 2059;
(3) identify and define the responsibilities of agency staff who produce, access, use, or serve as custodians of the agency’s information;
(4) identify risk management and other measures taken to protect the agency’s information from unauthorized access, disclosure, modification, or destruction;
(5) include:
(A) the best practices for information security developed by the department; or
(B) a written explanation of why the best practices are not sufficient for the agency’s security; and
(6) omit from any written copies of the plan information that could expose vulnerabilities in the agency’s network or online systems.
Terms Used In Texas Government Code 2054.133
- Jurisdiction: (1) The legal authority of a court to hear and decide a case. Concurrent jurisdiction exists when two courts have simultaneous responsibility for the same case. (2) The geographic area over which the court has authority to decide cases.
- Signed: includes any symbol executed or adopted by a person with present intention to authenticate a writing. See Texas Government Code 311.005
- Written: includes any representation of words, letters, symbols, or figures. See Texas Government Code 311.005
- Year: means 12 consecutive months. See Texas Government Code 311.005
(c) Not later than June 1 of each even-numbered year, each state agency shall submit a copy of the agency’s information security plan to the department. Subject to available resources, the department may select a portion of the submitted security plans to be assessed by the department in accordance with department rules.
(d) Each state agency’s information security plan is confidential and exempt from disclosure under Chapter 552.
(e) Each state agency shall include in the agency’s information security plan a written document that is signed by the head of the agency, the chief financial officer, and each executive manager designated by the state agency and states that those persons have been made aware of the risks revealed during the preparation of the agency’s information security plan.
(f) Not later than November 15 of each even-numbered year, the department shall submit a written report to the governor, the lieutenant governor, and each standing committee of the legislature with primary jurisdiction over matters related to the department evaluating information security for this state’s information resources. In preparing the report, the department shall consider the information security plans submitted by state agencies under this section, any vulnerability reports submitted under § 2054.077, and other available information regarding the security of this state’s information resources. The department shall omit from any written copies of the report information that could expose specific vulnerabilities in the security of this state’s information resources.