This standard establishes:
(1) a non-exhaustive record of technologies and technology service providers from which the university is prohibited from using and/or acquiring and
(2) a non-confidential explanation of technical and administrative controls implemented in the furtherance of related compliance goals.
Prohibitions highlighted in this standard correspond to state and federal laws, directives, executive orders, and other regulatory requirements applicable to the university. The absence of an otherwise prohibited item from this Standard does not imply a means by which the item is authorized.
The contents of this standard are additive overlays that incorporate, detail, and extend requirements set by the TSUS Information Technology Policies, institutional policies, other institutional standards, procedures, and guidelines, and additional prohibitions, such as the “Debarred Vendor List” maintained by the Texas Comptroller of Public Accounts.
Pursuant to section 552.139 of Texas Government Code (“Public Information”), some descriptions of technical security controls, procedures, and practices will be abbreviated to avoid disclosure of confidential information pertaining to the security posture of the university’s information resources.
This standard generally applies to all university-owned information systems, devices, networks, and other information resources that are within the custodianship of the university regardless of location.
As detailed within, certain sections of this standard may also be applicable to university personnel (e.g., university officers, employees, contractors), locations (e.g., campuses, properties), and personally owned devices (e.g., those used to conduct state or university business).
This section provides an overview of the requirements of this standard. This summary is provided for reference purposes and does not take the place of the full text below.
This standard was first published on 1/2/2023. This section will be updated when any updates or changes are made to this standard and further direction from Tx DIR.
The feasibility of exceptions to this standard and processes by which such exceptions may be facilitated will be detailed within the body of this document. Unlike certain security controls, policies, standards, and other requirements of the university, the regulatory nature of the prohibitions described by this standard significantly limits or prevents exceptions from being granted by the university’s agency head, information security officer, individual department heads, or other university personnel.
This prohibition stems from an OOG order issued on 12/7/22. As stated in the letter sent to state agency heads:
“…effective immediately, every state agency in Texas shall ban its officers and employees from downloading or using TikTok on any of its government-issued devices. This TikTok ban extends to all state-issued cell phones, laptops, tablets, desktop computers, and other devices capable of internet connectivity, and it must be strictly enforced by your agency’s IT department.”
For further information, see the following pages:
Effective 12/7/22, all university employees are prohibited from downloading or using TikTok on any university-owned or university-issued devices and other university information resources. Further, the installation or use of TikTok on university-owned or university-issued devices and other university information resources by any user, including contractors, students, sponsored student organizations, and non-affiliates, is prohibited.
Pursuant to the order, exceptions to this prohibition may be made with authorization from the university’s president as the designated state agency head.
As stated in the letter sent to state agency heads:
“As head of your agency, you may grant exceptions to enable law-enforcement investigations and other legitimate uses of TikTok on state-issued devices. This authority may not be delegated. These narrow exceptions must be reported to the Office of the Governor (OOG).”
As of 12/13/2022, the following exceptions have been approved by the university president:
In response to this prohibition of the use of the TikTok social media service on university-owned devices, a series of technical controls will be used. Technical controls include, but may not be limited to, the following:
Measures that have or will be taken include, but may not be limited to, the following:
Prior to the 12/7/22 order, parts of the university used TikTok as a component of social media strategies. In order to mitigate the likelihood of username reclamation and subsequent impersonation by threat actors, the following procedures are to be implemented by the respective information resource owner and information resource custodian of university-managed TikTok accounts:
Additional procedures may include temporarily logging on to the account from an authorized source to prevent deactivation of the account and loss of the account’s reserved username after a period of approximately 170 days of inactivity. These procedures may be activated based on several factors, including risk analysis, shifts in the threat landscape, and the status of authorized exceptions.