Search
/ Administration / Policies & Procedures / C Policy Index: Business and Support Services / CQB (TSBVI) Technology Resources: Cybersecurity

CQB (TSBVI) Technology Resources: Cybersecurity

CYBERSECURITY POLICY

TSBVI shall adopt a cybersecurity policy to:

  1. Secure School cyberinfrastructure against cyber attacks and other cybersecurity incidents: and
  2. Determine cybersecurity risk and implement mitigation planning.

TSBVI’s cybersecurity policy may not conflict with the information security standards for institutions of higher education adopted by the Department of Information Resources (DIR) under Government Code Chapters 2054 and 2059.

Cybersecurity Coordinator

The Superintendent shall designate a cybersecurity coordinator to serve as a liaison between TSBVI and the Texas Education Agency (TEA) in cybersecurity matters.

Report to TEA

The School’s cybersecurity coordinator shall report to TEA any cyber attack or other cybersecurity incident against TSBVI cyberinfrastructure that constitutes a breach of system security as soon as practicable after the discovery of the attack or incident.

Report to Parent

The School’s cybersecurity coordinator shall report to a parent of or person standing in parental relation to an enrolled student of an attack or incident for which a report is required to TEA involving the student’s information.

Definitions

For purposes of the School cybersecurity policy, the following definitions apply:

Breach of System Security

“Breach of system security” means an incident in which student information that is sensitive, protected, or confidential, as provided by state or federal law, is stolen or copied, transmitted, viewed or used by a person unauthorized to engage in that action.

Cyber Attack

“Cyber attack” means an attempt to damage, disrupt, or gain unauthorized access to a computer, computer network, or computer system.

Cybersecurity

“Cybersecurity” means the measures taken to protect a computer, computer network, or computer system against unauthorized use or access.

Education Code 11.175

CYBERSECURITY TRAINING

At least once each year, TSBVI shall identify employees who have access to a school computer system or database and use a computer to complete at least 25% of their required duties and board members to complete a cybersecurity training program certified under Government Code 2054.519 (state-certified cybersecurity training programs) or offered by TSBVI as described at Employee and Trustee Training Program, below.  Gov’t Code 2054.5191(a-1)

The Board may select the most appropriate state-certified cybersecurity training program or TSBVI training program for employees to complete.  The Board shall:

  1. Verify and report on the completion of a cybersecurity training program by school employees to the DIR; and
  2. Require periodic audits to ensure compliance with these provisions.

Gov’t Code 2054.5191(b)

Employee and Trustee Training Program

If TSBVI employs a dedicated information resources cybersecurity officer, it may offer a cybersecurity training program that satisfies the requirements described by Government Code 2054.519(b).  Gov’t Code 2054.519(f)

SECURITY BREACH NOTIFICATION

To Individuals

TSBVI shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.  The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the School determines that the breach occurred, except as provided at Criminal Investigation Exception, below, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Resident of Other State

If the individual whose sensitive personal information was (or is reasonably believed to have been) acquired by an unauthorized person is a resident of a state that requires a person that owns or licenses computerized data to provide notice of a breach of system security, the notice may be provided under that state’s law or under Notice, below.

To the Owner or License Holder

TSBVI shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Notice

TSBVI may give the required notice to individuals or the owner or license holder by providing:

  1. Written notice of the last known address of the individual;
  2. Electronic notice, if the notice is provided in accordance with 15 U.S.C. Section 7001 (electronic records and signatures); or
  3. If TSBVI demonstrates that the cost of providing notice would exceed $250,000, the number of affected persons exceeds 500,000, or the School does not have sufficient contact information, by:
    1. Electronic mail, if the School has electronic mail addresses for the affected persons;
    2. Conspicuous posting of the notice on the TSBVI website; or
    3. Notice published in or broadcast on major statewide media.

Information Security Policy

If TSBVI maintains its own notification procedures as part of an information security policy for the treatment of sensitive personal information and complies with the timing requirements for notice described above, the notice requirements are satisfied if the School notifies affected persons in accordance with that policy.

To the Attorney General

TSBVI shall notify the attorney general of that breach not later than the 60th day after the date on which the School determines that the breach occurred if the breach involves at least 250 residents of this state.  The notification must include:

  1. A detailed description of the nature and circumstances of the breach or the use of sensitive personal information acquired as a result of the breach;
  2. The number of residents of this state affected by the breach at the time of notification;
  3. The measures taken by TSBVI regarding the breach;
  4. Any measures the School intends to take regarding the breach after the notification described at Notice, above; and
  5. Information regarding whether law enforcement is engaged in investigating the breach.

To a Consumer Reporting Agency

If TSBVI is required to notify at one time more than 10,000 persons of a breach of system security, the School shall also notify each consumer reporting agency, as defined by 15 U.S.C. 1681a, that maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notices.  The School shall provide the notice without unreasonable delay.

Criminal Investigation Exception

TSBVI may delay providing the required notice to state residents or the owner or license holder at the request of a law enforcement agency that determines that the notification will impede a criminal investigation.  The notification shall be made as soon as the law enforcement agency determines that the notification will not compromise the investigation.

Business and Commerce Code 521.053; Local Gov’t Code 205.010

Definitions

For purposes of security breach notifications, the following definitions apply:

Breach of System Security

“Breach of system security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.  Good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.  Business and Commerce Code 521.053(a)

 “Sensitive Personal Information”

“Sensitive personal information” means:

  1. An individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted:
    1. Social security number;
    2. Driver’s license number or government-issued identification number; or
    3. Account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or
  2. Information that identifies an individual and relates to:
    1. The physical or mental health or condition of the individual;
    2. The provision of health care to the individual; or
    3. Payment for the provision of health care to the individual.

“Sensitive personal information” does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government.

Business and Commerce Code 521.002(a)(2), (b)

CYBERSECURITY INFORMATION SHARING ACT

TSBVI may, for a cybersecurity purpose and consistent with the protection of classified information, share with, or receive from, any other non-federal entity or the federal government a cyber threat indicator or defensive measure in accordance with the Cybersecurity Information Sharing Act, 6 U.S.C. Subchapter I (sections 1501-1510).  6 U.S.C. 1503(c)

Removal of Personal Information

TSBVI sharing a cyber threat indicator pursuant to these provisions shall, prior to sharing:

  1. Review such indicator to assess whether it contains any information not directly related to a cybersecurity threat that TSBVI knows at the time of sharing to be personal information of a specific individual or information that identifies a specific individual and remove such information; or
  2. Implement and utilize a technical capability configured to remove any information not directly related to a cybersecurity threat that TSBVI knows at the time of sharing to be personal information of a specific individual or information that identifies a specific individual.

6 U.S.C. 1503(d)(2)

Definitions

For purposes of the Cybersecurity Information Sharing Act, the following definitions apply:

Cybersecurity Purpose

“Cybersecurity Purpose” means the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability.  6 U.S.C. 1501(4)

Cybersecurity Threat

“Cybersecurity threat” means an action, not protected by the First Amendment to the United States Constitution, on or through an information system that may result in an unauthorized effort to adversely impact the security, availability, confidentiality, or integrity of an information system or information that is stored on, processed by, or transiting an information system.  The term does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement.  6 U.S.C. 1501(5)

Cyber Threat Indicator

“Cyber threat indicator” means information that is necessary to describe or identify:

  1. Malicious reconnaissance, as defined in 6 U.S.C. 1501(12), including anomalous patterns or communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability;
  2. A method of defeating a security control or exploitation of a security vulnerability;
  3. A security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability;
  4. A method of causing a user with legitimate to access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability;
  5. Malicious cyber command and control, as defined in 6 U.S.C. 1501(11)
  6. The actual or potential harm caused by an incident, including a description of the information exfiltrated as a result of a particular cybersecurity threat;
  7. Any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or
  8. Any combination thereof.

6 U.S.C. 1501(6)

Defensive Measure

“Defensive measure” means an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that detects, prevents, or mitigates a known or suspected cybersecurity threat or security vulnerability.  The term does not include a measure that destroys, renders unusable, provides unauthorized access to, or substantially harms an information system or information stored on, processed by, or transiting such information system not owned by the private entity operating the measure or another entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure.  6 U.S.C. 1507(7)

Information System

“Information system” has the meaning given the term in 44 U.S.C. 3502 and includes industrial control systems, such as supervisory control and data acquisition systems, distributed control systems, and programmable logic controllers.  6 U.S.C. 1501(9)

Security Control

“Security control” means the management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information.  6 U.S.C. 1501(16)

Security Vulnerability

“Security vulnerability” means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control.  6 U.S.C. 1501(17)

ACCESS TO ELECTRONIC COMMUNICATIONS

Electronic Communication Privacy Act

Except as otherwise provided in the Electronic Communication Privacy Act (ECPA), 18 U.S.C. 2510–22, a person commits an offense if the person:

  1. Intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, oral, or electronic communication;
  2. Intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication when:
    1. Such device is affixed to, or otherwise transmits a signal through, a wire, cable, or other like connection used in wire communication; or
    2. Such device transmits communications by radio, or interferes with the transmission of such communication; or
    3. Such person knows, or has reason to know, that such device or any component thereof has been sent through the mail or transported in interstate or foreign commerce; or
    4. Such use or endeavor to use takes place on the premises of any business or other commercial establishment the operations of which affect interstate or foreign commerce; or obtains or is for the purpose of obtaining information relating to the operations of any business or other commercial establishment the operations of which affect interstate or foreign commerce; or
    5. Such person acts in the District of Columbia, the Commonwealth of Puerto Rico, or any territory or possession of the United States;
  3. Intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the prohibited interception of a wire, oral, or electronic communication;
  4. Intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the prohibited interception of a wire, oral, or electronic communication; or
  5. Intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, intercepted by means authorized by 18 U.S.C. 2511(2)(a)(ii), 2511(2)(b)–(c), 2511(2)(e), 2516, and 2518; knowing or having reason to know that the information was obtained through the interception of such a communication in connection with a criminal investigation; having obtained or received the information in connection with a criminal investigation; and with intent to improperly obstruct, impede, or interfere with a duly authorized criminal investigation.

It shall not be unlawful for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the

communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any state.

18 U.S.C. 2511(1), (2)(d)

Stored Wire and Electronic Communications and Transactional Records Access Act

TSBVI must comply with the Stored Wire and Electronic Communications and Transactional Records Access Act, 18 U.S.C. 2701–12.

Whoever intentionally accesses without authorization a facility through which an electronic communication service is provided or intentionally exceeds an authorization to access that facility and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system commits an offense.  18 U.S.C. 2701(a)

Exceptions

This section does not apply with respect to conduct authorized:

  1. By the person or entity providing a wire or electronic communications service;
  2. By a user of that service with respect to a communication of or intended for that user; or
  3. By sections 18 U.S.C. 2703, 2704, or 2518.

18 U.S.C. 2701(c)

Definitions

Electronic Communication

“Electronic communication” means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo-electronic or photooptical system that affects interstate or foreign commerce.  18 U.S.C. 2510(12), 2711(1)

Electronic Storage

“Electronic storage” means:

  1. Any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and
  2. Any storage of such communication by an electronic communication service for purposes of backup protection of such communication.

18 U.S.C. 2510(17), 2711(1)

The term encompasses only the information that has been stored by an electronic communication service provider.  Information that an individual stores to the individual’s hard drive or cell phone is not in electronic storage under the statute.  Garcia v. City of Laredo, 702 F.3d 788 (5th Cir. 2012)

Electronic Communications System

“Electronic communications system” means any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications.  18 U.S.C. 2510(14), 2711(1)

Electronic Communication Service

“Electronic communication service” means any service which provides to users thereof the ability to send or receive wire or electronic communications.  18 U.S.C. 2510(15), 2711(1)

Facility

“Facility” includes servers operated by electronic communication service providers for the purpose of storing and maintaining electronic storage.  The term does not include technology, such as cell phones and computers, that enables the use of an electronic communication service.  Garcia v. City of Laredo, 702 F.3d 788 (5th Cir. 2012)

Person

“Person” means any employee, or agent of the United States or any state or political subdivision thereof, and any individual, partnership, association, joint stock company, trust, or corporation.  18 U.S.C. 2510(6), 2711(1)

Adopted:         8/9/99

Amended:       1/31/03, 5/29/12, 1/25/13, 4/6/18, 1/31/20

Reviewed:       4/1/05