South Plains College

Information Services (SPC-IS)

 

 

Security Awareness and Training Policy: I-G

 

Purpose

To ensure that all South Plains College information technology (SPC-IT) users receive the appropriate level of information security awareness training.

 

Policy

This policy applies to all departments and users of SPC technology resources and assets. All SPC employees, retirees, vendors, and other designated personnel must complete the assigned Security Awareness Training unless an exception has been granted and documented.

 

1. Security Awareness Training

The SPC ISO is responsible for:

 

1. Scheduling security awareness training as part of initial training for new users.

 

1. Scheduling security awareness training when required by information system changes and once a semester after that.

 

1. Determining the appropriate content of security awareness training and techniques based on the specific organizational requirements and the information systems to which personnel have authorized access. The content shall:

 

1. Include a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents.

 

1. Address awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.

 

1. Security Awareness | Insider Threat

SPC-ISO Department shall:

 

1. Include security awareness training on recognizing and reporting potential indicators of insider threat.

 

 

1. Role-Based Security Training

SPC-ISO Department shall:

 

1. Provide role-based security training to personnel with elevated security roles and responsibilities:

 

1. Before authorizing access to the information system or performing assigned duties.

 

1. When required by information system changes and once a semester after that.

 

 

1. Practical Exercises

SPC-ISO Department shall:

 

1. Provide practical exercises in security training that reinforce training objectives; practical exercises may include, for example, security training for users that includes simulated cyber-attacks and spear, or whale phishing attacks targeted at senior leaders. These practical exercises help users better understand the effects of such vulnerabilities and appreciate the need for a security mindset.

 

1. Suspicious Communications and Anomalous System Behavior

SPC-ISO Department shall:

 

1. Provide training to its specified staff on how to recognize suspicious communications and abnormal behavior in organizational information systems.

 

1. Security Training Records

The SPC-ISO shall:

 

1. Designate personnel to document and monitor individual information system security training activities, including basic security awareness training and specific information system security training.

 

1. Retain individual training records for one year.

 

Compliance

Employees who violate this policy may be subject to appropriate disciplinary action, including discharge and civil and criminal penalties. Non-employees, including, without limitation, contractors, may be subject to termination of contractual agreements, denial of access to IT resources, and other actions, as well as both civil and criminal penalties.

 

Policy Exceptions

Requests for exceptions to this policy must be submitted in writing and shall be reviewed by the Information Security Officer (ISO) and the Chief Information Officer (CIO). Departments requesting exceptions shall provide such requests to the CIO. The request should expressly state the scope of the exception along with justification for granting the exception, the potential impact or risk attendant upon granting the exception, risk mitigation measures to be undertaken by the IT Department, initiatives, actions, and a time frame for achieving the minimum compliance level with the policies set forth herein. The CIO shall review such requests and confer with the requesting department.

 

Related Documents (Appendix A)

State-Certified Cyber Security Training Programs.

Section 2054.519, Texas Government Code

 

Cybersecurity Training Required: Certain Employees and Officials.

Section 2054.5191, Texas Government Code

 

Cybersecurity Training Required: Certain State Contractors

Section 2054.5192, Texas Government Code

 

National Institute of Standards and Technology (NIST) Special Publications: NIST SP 800-53 – Awareness and Training (AT), NIST SP 800-12, NIST SP 800-16, NIST SP 800-50, NIST SP 800-100; Electronic Code of Federal Regulations (CFR): 5 CFR 930.301

 

Texas Security Controls Standards Catalog Control Group: AT-2, AT-3

 

NIST Function Groups: ID.AM-1, ID.AM-2, ID.AM-6, PR.AT-1

 

 

 

Appendix A

 

 

Sec. 2054.519.  STATE CERTIFIED CYBERSECURITY TRAINING PROGRAMS.  (a)  The department, in consultation with the cybersecurity council established under Section 2054.512 and industry stakeholders, shall annually:

(1)  certify at least five cybersecurity training programs for state and local government employees; and

(2)  update standards for maintenance of certification by the cybersecurity training programs under this section.

(b)  To be certified under Subsection (a), a cybersecurity training program must:

(1)  focus on forming information security habits and procedures that protect information resources; and

(2)  teach best practices for detecting, assessing, reporting, and addressing information security threats.

(c)  The department may identify and certify under Subsection (a) training programs provided by state agencies and local governments that satisfy the training requirements described by Subsection (b).

(d)  The department may contract with an independent third party to certify cybersecurity training programs under this section.

(e)  The department shall annually publish on the department's Internet website the list of cybersecurity training programs certified under this section.

(f)  Repealed by Acts 2021, 87th Leg., R.S., Ch. 51 (H.B. 1118), Sec. 5, eff. May 18, 2021.

 

Added by Acts 2019, 86th Leg., R.S., Ch. 1308 (H.B. 3834), Sec. 3, eff. June 14, 2019.

Amended by:

Acts 2021, 87th Leg., R.S., Ch. 51 (H.B. 1118), Sec. 5, eff. May 18, 2021.

 

 

Sec. 2054.5191.  CYBERSECURITY TRAINING REQUIRED: CERTAIN EMPLOYEES AND OFFICIALS.  (a)  Each state agency shall identify state employees who use a computer to complete at least 25 percent of the employee's required duties.  At least once each year, an employee identified by the state agency and each elected or appointed officer of the agency shall complete a cybersecurity training program certified under Section 2054.519.

(a-1)  At least once each year, a local government shall:

(1)  identify local government employees and elected and appointed officials who have access to a local government computer system or database and use a computer to perform at least 25 percent of the employee's or official's required duties; and

(2)  require the employees and officials identified under Subdivision (1) to complete a cybersecurity training program certified under Section 2054.519.

(a-2)  The governing body of a local government or the governing body's designee may deny access to the local government's computer system or database to an individual described by Subsection (a-1)(1) who the governing body or the governing body's designee determines is noncompliant with the requirements of Subsection (a-1)(2).

(b)  The governing body of a local government may select the most appropriate cybersecurity training program certified under Section 2054.519 for employees and officials of the local government to complete. The governing body shall:

(1)  verify and report on the completion of a cybersecurity training program by employees and officials of the local government to the department; and

(2)  require periodic audits to ensure compliance with this section.

(c)  A state agency may select the most appropriate cybersecurity training program certified under Section 2054.519 for employees of the state agency. The executive head of each state agency shall verify completion of a cybersecurity training program by employees of the state agency in a manner specified by the department.

(d)  The executive head of each state agency shall periodically require an internal review of the agency to ensure compliance with this section.

(e)  The department shall develop a form for use by state agencies and local governments in verifying completion of  cybersecurity training program requirements under this section. The form must allow the state agency and local government to indicate the percentage of employee completion.

(f)  The requirements of Subsections (a) and (a-1) do not apply to employees and officials who have been:

(1)  granted military leave;

(2)  granted leave under the federal Family and Medical Leave Act of 1993 (29 U.S.C. Section 2601 et seq.);

(3)  granted leave related to a sickness or disability covered by workers' compensation benefits, if that employee no longer has access to the state agency's or local government's database and systems;

(4)  granted any other type of extended leave or authorization to work from an alternative work site if that employee no longer has access to the state agency's or local government's database and systems; or

(5)  denied access to a local government's computer system or database by the governing body of the local government or the governing body's designee under Subsection (a-2) for noncompliance with the requirements of Subsection (a-1)(2).

 

Added by Acts 2019, 86th Leg., R.S., Ch. 1308 (H.B. 3834), Sec. 3, eff. June 14, 2019.

Amended by:

Acts 2021, 87th Leg., R.S., Ch. 51 (H.B. 1118), Sec. 2, eff. May 18, 2021.

Acts 2021, 87th Leg., R.S., Ch. 51 (H.B. 1118), Sec. 3, eff. May 18, 2021.

 

 

Sec. 2054.5192.  CYBERSECURITY TRAINING REQUIRED: CERTAIN STATE CONTRACTORS.  (a)  In this section, "contractor" includes a subcontractor, officer, or employee of the contractor.

(b)  A state agency shall require any contractor who has access to a state computer system or database to complete a cybersecurity training program certified under Section 2054.519 as selected by the agency.

(c)  The cybersecurity training program must be completed by a contractor during the term of the contract and during any renewal period.

(d)  Required completion of a cybersecurity training program must be included in the terms of a contract awarded by a state agency to a contractor.

(e)  A contractor required to complete a cybersecurity training program under this section shall verify completion of the program to the contracting state agency.  The person who oversees contract management for the agency shall:

(1)  not later than August 31 of each year, report the contractor's completion to the department; and

(2)  periodically review agency contracts to ensure compliance with this section.

 

Added by Acts 2019, 86th Leg., R.S., Ch. 1308 (H.B. 3834), Sec. 3, eff. June 14, 2019.

Amended by:

Acts 2021, 87th Leg., R.S., Ch. 856 (S.B. 800), Sec. 12, eff. September 1, 2021.