Table of Contents

• Purpose
• Policy Statement
• Applicability
• Compliance with Federal Law
• Security Standards
  • CRSP Standard 3.0: CUI Governance
  • CRSP Standard 3.1: Access Control (AC)
  • CRSP Standard 3.2: Awareness and Training (AT)
  • CRSP Standard 3.3: Audit and Accountability (AU)
  • CRSP Standard 3.4: Configuration Management (CM)
  • CRSP Standard 3.5: Identification and Authentication (IA)
  • CRSP Standard 3.6: Incident Response (IR)
  • CRSP Standard 3.7: Maintenance (MA)
  • CRSP Standard 3.8: Media Protection (MP)
  • CRSP Standard 3.9: Personnel Security (PS)
  • CRSP Standard 3.10: Physical Protection (PE)
  • CRSP Standard 3.11: Risk Assessment (RA)
  • CRSP Standard 3.12: Security Assessment (CA)
  • CRSP Standard 3.13: System and Communications Protection (SC)
  • CRSP Standard 3.14: System and Information Integrity (SI)
  • CRSP Standard 3.15: Planning (PL)
  • CRSP Standard 3.16: System and Services Acquisition (SA)
  • CRSP Standard 3.17: Supply Chain Risk Management (SR)
• Definitions
• Relevant Federal and State Statutes and Regulations
• Program Overview and Authority
• Revision History

Purpose

A supplement to the Information Resources Use and Security Policy (IRUSP) establishing specific requirements for the protection of Controlled Unclassified Information (CUI) in university research activities.

The Information Resources Use and Security Policy (IRUSP) provides the University of Texas at Austin with foundational requirements for the protection of all university information resources. This Policy supplements the IRUSP and establishes specific requirements for the protection of Controlled Unclassified Information (CUI) used in research activities governed by NIST SP 800-171.

This Policy establishes the authority for the Office of Research Support and Compliance (ORSC) and the Information Security Office (ISO) to implement and enforce the requirements of this Policy for CUI systems participating in the Controlled Research Support Program (CRSP).

Policy Statement

It is the policy of the university to:

• Protect Controlled Unclassified Information (CUI) used in research activities against unauthorized access, disclosure, modification, or destruction, in compliance with NIST SP 800-171 and applicable federal regulations;
• Establish and maintain a Controlled Research Support Program (CRSP) that provides centrally managed security controls for research projects handling CUI;
• Ensure that all researchers, Principal Investigators, and research support staff who access CUI understand and comply with applicable security requirements; and
• Maintain compliance with federal regulations governing controlled research data, including requirements associated with the Cybersecurity Maturity Model Certification (CMMC) and International Traffic in Arms Regulations (ITAR), as applicable to sponsored research agreements.

Applicability

This Policy applies to:

• All CUI processed, stored, or transmitted within U. T. Austin information resources in connection with sponsored research activities;
• All CUI systems, services, and infrastructure that are enrolled in the Controlled Research Support Program (CRSP).
• All Principal Investigators (PIs), researchers, staff, students, and third-party collaborators who access CUI in support of U. T. Austin research activities; and
• All vendors, contractors, and service providers that handle CUI on behalf of U. T. Austin research programs.

This Policy does not apply to research data that does not meet the definition of CUI as established by the National Archives and Records Administration (NARA) CUI Registry, or to general university information resources governed solely by the IRUSP.

Compliance with Federal Law

Research involving CUI is subject to federal regulations and contractual obligations that govern the handling, protection, and dissemination of controlled information. U. T. Austin research programs receiving federal funding or performing work under federal contracts must comply with NIST SP 800-171 as incorporated by reference in the Defense Federal Acquisition Regulation Supplement (DFARS) and other applicable federal acquisition regulations.

Failure to comply with applicable requirements may result in the loss of federal funding, contract termination, or other legal consequences. Nothing in this Policy is intended to prohibit or restrict legitimate research activities, the exchange of information necessary to conduct research, or collaboration with authorized partners in compliance with applicable federal regulations and sponsored research agreements.

Security Standards

The following standards establish the specific security requirements applicable to CUI systems and research activities covered by this Policy. Each standard corresponds to a control family defined in NIST SP 800-171 Rev. 3. Compliance with these standards is mandatory for all covered systems, personnel, and activities.

About the numbering: CRSP Standards are numbered to align with the NIST SP 800-171 Rev. 3 control family structure (e.g., Standard 3.1 corresponds to NIST family 3.1 — Access Control, Standard 3.2 to family 3.2 — Awareness and Training, and so on). Controls within each standard follow the same scheme (e.g., 03.01.01, 03.01.02).

CRSP Standard 3.0 CUI Governance 

CRSP Standard 3.1 Access Control (AC) 

CRSP Standard 3.2 Awareness and Training (AT) 

CRSP Standard 3.3 Audit and Accountability (AU) 

CRSP Standard 3.4 Configuration Management (CM) 

CRSP Standard 3.5 Identification and Authentication (IA) 

CRSP Standard 3.6 Incident Response (IR) 

CRSP Standard 3.7 Maintenance (MA) 

CRSP Standard 3.8 Media Protection (MP) 

CRSP Standard 3.9 Personnel Security (PS) 

CRSP Standard 3.10 Physical Protection (PE) 

CRSP Standard 3.11 Risk Assessment (RA) 

CRSP Standard 3.12 Security Assessment (CA) 

CRSP Standard 3.13 System and Communications Protection (SC) 

CRSP Standard 3.14 System and Information Integrity (SI) 

CRSP Standard 3.15 Planning (PL) 

CRSP Standard 3.16 System and Services Acquisition (SA) 

CRSP Standard 3.17 Supply Chain Risk Management (SR) 

CRSP Standard 3.0: CUI Governance

UT Austin CRSP 3.0 CUI Governance Policy

Purpose of Policy

The purpose of this policy is to establish a formal, centralized governance framework for The University of Texas at Austin (UT Austin) that defines how information security, compliance, and risk management requirements are interpreted, implemented, and enforced for CUI systems, services, and infrastructure enrolled in the Controlled Research Support Program (CRSP).

This Governance Policy serves as the authoritative institutional framework for security governance and control alignment, ensuring consistent implementation of applicable requirements across federal, state, University of Texas System (UTS), and institutional domains.

All subordinate information security policies, standards, procedures, plans, and system-level documentation applicable to CUI systems enrolled in CRSP shall derive authority from and align with this policy. Such subordinate documentation shall implement the requirements defined herein and shall not conflict with applicable regulatory, contractual, or institutional obligations.

This policy governs UT Austin’s institutional implementation of the following authoritative requirements:

• NIST Special Publication 800-171 Revision 3
• Texas Administrative Code (TAC) Chapter 202
• DIR Security Control Standards Catalog
• University of Texas System (UTS 165) policies and standards
• UT Austin Information Resources Use and Security Policy (IRUSP)
• Applicable federal laws, regulations, and contractual requirements, including DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting)

Where multiple requirements apply, the most stringent applicable requirement shall govern.

This governance framework:

• Ensures consistent interpretation, implementation, and enforcement of security and compliance requirements
• Establishes clear accountability and control ownership across the institution
• Enables risk-based decision-making and formal authorization processes
• Provides traceability across regulatory, contractual, and institutional requirements
• Supports audit readiness, continuous monitoring, and CMMC Level 2 compliance
• Reduces duplication and fragmentation across institutional governance artifacts

Scope of Policy

Scope of Applicability

This policy applies to all University of Texas at Austin (UT Austin) personnel, organizational units, contractors, consultants, affiliates, and third-party service providers who design, develop, operate, maintain, or otherwise support CUI systems enrolled in CRSP that create, receive, process, store, transmit, or otherwise handle Controlled Unclassified Information (CUI).

The scope of this policy includes:

• All CUI systems, applications, infrastructure components, and supporting services enrolled in CRSP
• All components formally designated as part of the applicable CUI system boundary
• All environments, processes, and activities supporting the protection and management of CUI

Systems, applications, services, and infrastructure components are considered in scope only when they have been formally designated, documented, and authorized as part of the applicable CUI system boundary through established institutional governance, risk management, and system authorization processes.

Institutional information resources outside the applicable CUI system boundary are out of scope unless and until they are formally incorporated into a CUI system in accordance with institutional governance processes.

Explicit Exclusions

Unless explicitly authorized and incorporated into the applicable CUI system boundary, this policy does not apply to:

• General university enterprise systems that do not create, receive, process, store, transmit, or otherwise handle CUI in support of CRSP
• Institutional administrative systems (e.g., human resources, financial management, procurement, student information systems) not designated as CUI systems
• General-purpose information technology services (e.g., enterprise email, collaboration platforms, learning management systems, campus network services) not specifically configured, secured, and approved for CUI processing on CUI systems enrolled in CRSP
• Public-facing websites, applications, or research systems that do not contain or provide access to CUI
• Personally owned or unmanaged devices that are not explicitly authorized to access CUI, connect to CUI systems, or process CUI as part of CRSP

Governance Coverage

This Governance Policy establishes the institutional framework for the management, protection, and oversight of CUI on CUI systems enrolled in CRSP. At a minimum, this policy governs the following domains:

• Governance Structure and Accountability Establishment of roles, responsibilities, and lines of authority for CUI protection
• Policy and Control Framework Management Development, approval, maintenance, and enforcement of security policies, standards, procedures, baselines, and system security plans
• Risk Management and Compliance Oversight Implementation of risk management processes, including risk assessments, control assessments, authorization decisions, and ongoing compliance monitoring
• Auditability, Documentation, and Records Management Maintenance of complete, accurate, and auditable documentation, including system inventories, security artifacts, logs, and compliance evidence
• Continuous Monitoring and Operational Assurance Ongoing visibility into system security posture, control effectiveness, and emerging risks
• Regulatory and Contractual Alignment Integration of applicable institutional, state, federal, and contractual requirements governing the protection of CUI

Authoritative Scope and Alignment

This policy serves as the authoritative governance document for all CUI systems handling CUI at UT Austin and establishes the minimum required controls necessary to maintain compliance with:

• NIST Special Publication 800-171 Revision 3
• Texas Administrative Code (TAC) Chapter 202
• DIR Security Control Standards Catalog
• University of Texas System (UTS 165) policies and standards
• UT Austin Information Resources Use and Security Policy (IRUSP)
• Applicable federal laws, regulations, contractual obligations, and sponsor requirements

These authorities are implemented through the following governance hierarchy:

• TAC Chapter 202 → Regulatory requirements
• DIR Security Control Standards Catalog → Mandatory control baseline
• UTS 165 policies → System-wide governance requirements
• UT Austin IRUSP standards → Institutional implementation and enforcement

Where multiple requirements apply, the most stringent applicable requirement shall govern.

Relationship to Subordinate Documentation

Subordinate policies, standards, procedures, plans, and operational guidance shall be developed and maintained to implement and support this Governance Policy.

Such documentation shall:

• Align with the governance framework defined in this policy
• Be formally reviewed, approved, and maintained through established governance processes
• Clearly define roles, responsibilities, control ownership, and implementation procedures
• Provide sufficient documentation and evidence to support:
  • Auditability
  • Compliance validation
  • Continuous monitoring

Subordinate documentation shall not reinterpret, override, or conflict with applicable statutory, regulatory, contractual, or institutional requirements.

Conflict Resolution and Escalation

In the event of conflicting requirements:

• The conflict shall be formally documented
• Evaluated through established risk management processes
• Escalated to appropriate governance authorities for resolution and formal approval

All decisions shall be documented and maintained to support audit traceability and compliance validation.

Authorities and Compliance Requirements

3.1 Authoritative Basis

This policy is governed by a comprehensive set of regulatory, statutory, institutional, and contractual authorities that establish the minimum security, privacy, and risk management requirements for CUI systems enrolled in CRSP.

The following authorities collectively define the requirements implemented through this Governance Policy:

• NIST Special Publication (SP) 800-171 Revision 3 Establishes the baseline security requirements for protecting Controlled Unclassified Information (CUI) in non-federal information systems and organizations.
• Texas Administrative Code (TAC) Chapter 202 Defines mandatory information security requirements for Texas state agencies and institutions of higher education, including governance, risk management, and control implementation obligations.
• Texas Department of Information Resources (DIR) Security Control Standards Catalog Establishes the required security control baseline aligned with NIST SP 800-53 and mandated under TAC §202.76 for implementation across state institutions.
• University of Texas System (UTS 165) Policies and Standards Provides system-wide governance requirements for information security, including risk management, access control, monitoring, and compliance oversight.
• UT Austin Information Resources Use and Security Policy (IRUSP) Defines institutional standards for implementing security controls, managing information resources, and enforcing operational security requirements.
• Applicable Federal Laws, Regulations, and Contractual Requirements Includes obligations associated with handling CUI, including but not limited to:
  • DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
  • Sponsor-imposed security requirements
  • Federal agency security and data protection requirements

3.2 Requirement Hierarchy and Governance Model

This policy establishes a layered governance model that defines how security requirements are inherited, interpreted, and enforced within UT Austin.

The authoritative hierarchy governing CUI systems is defined as follows:

Hierarchy Interpretation

• Federal Requirements (NIST SP 800-171, DFARS) Establish the baseline security requirements for protecting CUI
• TAC Chapter 202 Serves as the primary regulatory authority, establishing mandatory compliance requirements for the institution.
• DIR Security Control Standards Catalog Defines the required control baseline, operationalizing TAC requirements into enforceable security controls.
• UT System (UTS 165) Policies Provide system-wide governance and oversight, ensuring consistent implementation across all UT institutions.
• UT Austin IRUSP Standards Define institution-specific implementation requirements, procedures, and enforcement mechanisms.
• CUI System-Level Controls Implement technical, procedural, and operational controls to meet all upstream requirements within specific system environments.

3.3 Application of Requirements

All CUI systems and supporting organizations shall:

• Implement security controls in accordance with NIST SP 800-171 Rev. 3, as tailored by institutional governance
• Comply with all applicable TAC 202 regulatory requirements
• Implement controls defined in the DIR Security Control Standards Catalog
• Align with UT System and UT Austin policies and standards
• Adhere to contractual and federal requirements governing CUI, including DFARS where applicable

Where multiple authorities apply:

• The most stringent applicable requirement shall govern
• Requirements shall be harmonized through institutional governance processes
• Conflicts shall be addressed through risk management and formal escalation procedures

3.4 Control Alignment and Traceability

This Governance Policy establishes a formal control alignment model that ensures:

• All security controls are traceable to one or more authoritative requirements
• Control implementation is consistent across CUI systems
• Documentation supports:
  • Regulatory compliance
  • Security assessments and audits
  • CMMC Level 2 validation

Traceability shall be maintained through:

• System Security Plans (SSPs)
• Control assessment documentation
• Plans of Action and Milestones (POA&Ms)
• Control traceability matrices (Appendix B, where applicable)

3.5 Supersession and Conflict Resolution

In the event of conflicting requirements across governing authorities:

• The most restrictive or protective requirement shall apply
• The conflict shall be:
  • Documented
  • Evaluated through risk management processes
  • Escalated to appropriate governance authorities

Final determinations shall be:

• Formally approved by authorized decision-makers
• Documented and maintained for audit traceability
• Incorporated into updated controls or governance guidance as necessary

Departments and Responsibilities

Departments, roles, and associated responsibilities for the development, approval, implementation, and maintenance of information security governance for CUI systems enrolled in CRSP are established to ensure clear accountability across governance, operational, and technical domains.

This governance model ensures that CUI systems and supporting organizations operate in compliance with all applicable regulatory, statutory, institutional, and contractual requirements.

4.1 Governance Alignment Responsibilities

Responsible parties shall ensure that CUI systems:

• Comply with applicable federal and contractual requirements, including:
  • NIST SP 800-171 Rev. 3
  • DFARS 252.204-7012, where applicable
• Align with Texas Administrative Code (TAC) Chapter 202 as the governing regulatory framework
• Implement required controls in accordance with the DIR Security Control Standards Catalog
• Adhere to University of Texas System (UTS 165) policies and standards
• Implement institutional requirements defined by the UT Austin Information Resources Use and Security Policy (IRUSP)
• Maintain alignment with all applicable sponsor-imposed and contractual obligations governing CUI

4.2 Accountability Domains

This structured governance framework establishes accountability across the following domains:

Policy and Standards Governance

• Development, review, approval, and maintenance of:
  • Information security policies
  • Standards and procedures
  • Control baselines and governance artifacts

Security Control Implementation and Validation

• Implementation of required controls across CUI systems
• Validation of control effectiveness through:
  • Assessments
  • Testing
  • Continuous monitoring activities

Risk Management and Compliance Oversight

• Identification, assessment, and management of risks to CUI
• Enforcement of compliance with regulatory, institutional, and contractual requirements
• Formal risk acceptance and authorization processes

Continuous Monitoring and Operational Assurance

• Ongoing monitoring of:
  • System security posture
  • Control effectiveness
  • Emerging threats and vulnerabilities
• Integration with:
  • Incident response processes
  • Vulnerability management programs
  • Audit and compliance activities

Auditability and Evidence Management

• Maintenance of documentation and records sufficient to demonstrate:
  • Control implementation
  • Operational effectiveness
  • Compliance with applicable requirements
• Support for:
  • Internal audits
  • External assessments (e.g., CMMC, DIR reviews)
  • Regulatory and contractual reporting obligations

4.3 Responsibility Enforcement

All departments, personnel, and third-party entities participating in CRSP shall:

• Fulfill assigned responsibilities in accordance with this policy
• Maintain documentation and evidence supporting their assigned responsibilities
• Participate in governance, risk management, and compliance processes as required

Failure to meet assigned responsibilities may result in:

• Escalation through governance and risk management channels
• Revocation of system access or authorization
• Additional corrective actions in accordance with institutional policy

The table below outlines key departments and their associated governance responsibilities:

Departments and Responsibilities

Governed Control Families and Objectives

5.1 Overview

This section defines the NIST Special Publication (SP) 800-171 Revision 3 control families and associated control objectives governed by this policy for CUI systems enrolled in CRSP.

This section establishes institutional expectations for how required security controls are:

• Implemented, managed, and sustained
• Operationalized through subordinate policies, standards, procedures, and system-level documentation
• Integrated across governance, risk management, and security operations

Control implementation under this policy aligns with the governance hierarchy defined in Section 3, ensuring compliance with:

• Federal and contractual requirements (e.g., NIST SP 800-171 Rev. 3, DFARS 252.204-7012)
• Texas Administrative Code (TAC) Chapter 202
• DIR Security Control Standards Catalog
• UT System (UTS 165) policies
• UT Austin IRUSP standards

5.2 Governance Authority and Control Alignment

This Governance Policy serves as the authoritative institutional control framework for CUI systems.

It establishes formal alignment between:

• Federal baseline requirements (NIST SP 800-171 and contractual obligations)
• State regulatory requirements (TAC Chapter 202)
• DIR-mandated control baseline
• UT System governance requirements
• UT Austin institutional implementation standards (IRUSP)

Control implementation shall be:

• Consistent across all CUI systems
• Traceable to authoritative regulatory and contractual sources
• Defensible for audit, assessment, and compliance validation
• Integrated across governance, risk management, and operational functions

5.3 Control Implementation Requirements

Subordinate policies, standards, procedures, and system-level documentation shall implement and support the control families defined in this policy.

5.3.1 IMPLEMENTATION OF CONTROL OBJECTIVES

• Enforce NIST SP 800-171 Rev. 3 control families as governed by this policy
• Ensure controls are implemented consistently with all applicable upstream requirements

5.3.2 AUTHORITATIVE TRACEABILITY

• Maintain traceability to:
  • TAC Chapter 202
  • DIR Security Control Standards Catalog
  • UTS 165 policies
  • UT Austin IRUSP standards
  • Federal and contractual requirements

5.3.3 ROLES AND RESPONSIBILITIES

• Clearly define and document:
  • Control owners
  • System owners
  • Data owners
  • Responsible organizational units

5.3.4 DOCUMENTATION AND EVIDENCE

• Maintain documentation demonstrating control implementation and effectiveness, including:
  • System Security Plans (SSPs)
  • Security assessment results
  • Plans of Action and Milestones (POA&Ms)
  • Audit logs and monitoring records

5.3.5 SUPPORTING PROCESSES AND PROCEDURES

• Establish operational workflows, procedures, and technical mechanisms necessary to:
  • Implement controls
  • Monitor control effectiveness
  • Sustain control operations

5.3.6 AUDITABILITY AND ASSESSMENT READINESS

• Ensure controls are implemented in a manner that supports:
  • Independent assessments
  • CMMC Level 2 validation
  • Continuous monitoring activities

5.4 Control Inheritance and Shared Responsibility

Where control implementation involves shared services or inherited controls (e.g., cloud providers or enterprise IT services):

• Control inheritance relationships shall be formally documented
• Shared responsibility boundaries shall be clearly defined
• Inherited controls shall be validated to ensure compliance with the requirements of this Policy

5.5 Application of Multiple Regulatory Authorities

CUI systems are subject to overlapping regulatory, contractual, and institutional requirements.

Where multiple requirements apply:

• The most stringent requirement shall govern
• Conflicts shall be:
  • Formally documented
  • Evaluated through risk management processes
  • Escalated through governance channels
• Final determinations shall be:
  • Approved by designated authorities
  • Documented for audit traceability
  • Incorporated into control implementation or governance updates

5.6 Continuous Governance and Control Evolution

Control implementation shall be continuously evaluated and improved to maintain effectiveness and compliance.

Controls shall be:

• Periodically reviewed based on:
  • Regulatory and contractual updates
  • Institutional policy changes
  • Audit and assessment findings
  • Emerging threats and vulnerabilities
• Updated as necessary to ensure:
  • Continued effectiveness
  • Compliance with evolving requirements
  • Alignment with operational risk conditions affecting CUI systems

5.7 Control Family Implementation

The following control families are governed under this policy:

Access Control (03.01.01 – 03.01.22)

Control Objective

Establish, implement, and maintain comprehensive access control mechanisms to ensure that access to Controlled Unclassified Information (CUI) and CUI systems is restricted to authorized users, processes, and devices in accordance with least privilege, separation of duties, and institutional security requirements.

Guidance Objectives

CUI systems shall implement and enforce the following access control practices:

• Account Management and Lifecycle Control Establish and maintain an institution-wide account management program governing provisioning, modification, suspension, disabling, removal, and periodic review of accounts. Controls shall include inactivity management, timely deprovisioning, and full auditability of account actions.
• Least Privilege and Logical Access Enforcement Enforce logical access controls using role-based access control (RBAC), attribute-based access control (ABAC), or equivalent mechanisms to ensure users are granted only the minimum access necessary. Separation of duties shall be implemented to reduce risk.
• Device and Endpoint Access Restrictions Restrict access to authorized and managed devices, including mobile and wireless systems. Maintain accurate endpoint inventories and enforce device security requirements consistent with institutional standards.
• Remote Access and External System Controls Control and monitor remote access and access from external systems, requiring documented authorization, multifactor authentication (MFA), encryption, and formal agreements for third-party connectivity.
• Public Access and Information Release Controls Ensure CUI is not exposed through publicly accessible services. Implement safeguards, approval workflows, and user training to prevent unauthorized disclosure.
• Session Management Controls Enforce session lock, timeout, termination, and reauthentication requirements to protect active sessions.
• User Awareness and Monitoring Require access control–specific security training and monitor user activity to detect and respond to unauthorized access or misuse.

Authoritative References

The following authoritative sources define and govern access control requirements for CUI systems:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C (Institutions of Higher Education)

• §202.72 – Staff Responsibilities

Requires formal designation of information owners, custodians, and users

Requires approval and periodic review of access to information resources based on risk management decisions [txrules.elaws.us]

• §202.74 – Institution Information Security Program

Requires implementation of an institution-wide security program, including logical access controls and safeguards

• §202.75 – Managing Security Risks

Requires risk-based access control decisions and ongoing risk assessment processes

• §202.76 – Security Control Standards Catalog

Mandates implementation of required security controls based on the DIR Security Control Standards Catalog

• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)

Establishes requirements for cloud services, including access control, authorization, and secure connectivity expectations

Texas Department of Information Resources (DIR)

DIR Security Control Standards Catalog (mandated by TAC §202.76)

• Establishes mandatory baseline security controls aligned to NIST SP 800-53 Rev. 5, including:
  • AC (Access Control) – account management, least privilege, remote access
  • IA (Identification and Authentication) – MFA and identity validation
  • AU (Audit and Accountability) – monitoring and logging of access
  • CM (Configuration Management) – device and endpoint restrictions

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
  • Establishes system-wide governance, accountability, and security expectations
• UTS 165.2 – Information Security Technology Policy
  • Section 4.1 – Access Management Objectives, including:
  • Identity lifecycle management (provisioning, modification, revocation)
  • Segregation of duties and least privilege
  • Federated identity and authentication requirements

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

IRUSP Policy https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards for Access Control:

• Standard 4 – Access Management (primary control authority)
• Standard 5 – Administrative/Special Access Accounts
• Standard 15 – Passwords
• Standard 17 – Security Monitoring
• Standard 18 – Security Training
• Standard 19 – Server and Device Configuration and Management
• Standard 22 – Vendor and Third-Party Controls and Compliance

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

This clause establishes mandatory requirements for systems handling Covered Defense Information (CDI), including:

• Implementation of NIST SP 800-171 security controls, including Access Control [ecfr.gov]
• Requirement to provide “adequate security” to prevent unauthorized access, disclosure, or modification [legalclarity.org]
• Enforcement of access restrictions and monitoring mechanisms
• Flow-down of access control requirements to subcontractors
• Cyber incident reporting within 72 hours and preservation of audit evidence

Awareness and Training (03.02.01 – 03.02.02)

Control Objective

Establish, implement, and maintain an institution-wide awareness and training program to ensure that all personnel understand their information security responsibilities, risks associated with Controlled Unclassified Information (CUI), and required practices for protecting CUI systems and data.

Guidance Objectives

CUI systems and supporting organizations shall implement the following:

• Security Awareness Program Implement an institution-wide security awareness and training program that addresses:
  • Security literacy and acceptable use
  • Phishing and social engineering awareness
  • Insider threat awareness
  • Proper handling, storage, and transmission of CUI
• Role-Based Security Training Provide role-based and specialized security training for personnel with:
  • Elevated privileges
  • System administration responsibilities
  • Access to CUI

Such training shall be completed prior to granting access and updated periodically based on role, risk, and system changes.

• Training Frequency and Reinforcement Deliver initial training upon onboarding and recurring training at defined intervals (e.g., annually), with additional targeted training as required based on risk or incidents.
• Training Records and Auditability Maintain documentation of training completion, participation, and effectiveness sufficient to demonstrate:
  • Compliance with institutional and regulatory requirements
  • Coverage of all applicable personnel
  • Evidence for audit, assessment, and continuous monitoring activities

Authoritative References

The following authoritative sources define and govern awareness and training requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.74 – Institution Information Security Program
  • Requires implementation of a comprehensive information security program, including training, awareness, and personnel preparedness
• §202.75 – Managing Security Risks
  • Requires risk-based controls, including training to reduce human-related risks
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined security controls, including awareness and training

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)
  • AT – Awareness and Training Control Family, including:
  • AT-1 – Awareness and Training Policy and Procedures
  • AT-2 – Security Awareness Training (including phishing and insider threat)
  • AT-3 – Role-Based Training
  • AT-4 – Training Records

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.4 – Awareness and Training Objectives, including:
  • Definition of institutional training requirements
  • Establishment of role-based training expectations
  • Alignment with NIST and DIR awareness and training controls [utsystem.edu]

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

IRUSP Policy https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 18 – Security Training (Primary)
• Standard 2 – Acceptable Use of Information Resources (Supporting awareness behaviors)
• Standard 17 – Security Monitoring (Supports effectiveness validation through behavior monitoring)

These standards collectively define:

• Required security awareness training
• User responsibilities for protecting information resources
• Institutional expectations for security behavior and compliance

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Awareness and Training
• Personnel training as part of providing “adequate security” for Covered Defense Information (CDI)

Audit and Accountability (03.03.01 – 03.03.08)

Control Objective

Establish, implement, and maintain audit and accountability controls to ensure that security-relevant events are logged, monitored, analyzed, and retained to support detection, investigation, reporting, and response to unauthorized or inappropriate activity involving Controlled Unclassified Information (CUI) and CUI systems.

Guidance Objectives

CUI systems shall implement and enforce the following:

• Audit Logging and Event Capture Generate and retain audit logs capturing security-relevant events, including authentication, access, privilege use, system changes, and administrative actions. Logs shall contain sufficient detail to support attribution, accountability, and forensic investigation.
• Time Synchronization and Timestamp Integrity Ensure audit logs include accurate and consistent timestamps synchronized to authoritative time sources to support correlation and incident analysis.
• Log Review, Analysis, and Reporting Establish processes for regular review and analysis of audit logs to detect anomalies, suspicious behavior, or policy violations. Define escalation and response procedures for identified issues and audit failures.
• Protection of Audit Information Protect audit logs and associated records from unauthorized access, modification, deletion, or loss through appropriate access controls, encryption, and integrity monitoring.
• Retention and Availability of Audit Records Retain audit records in accordance with institutional, regulatory, and contractual requirements to support investigations, compliance validation, and legal obligations.

Authoritative References

The following authoritative sources define and govern audit and accountability requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.73 – Security Reporting

Requires reporting of security incidents and events, which depends on effective logging and monitoring capabilities

• §202.74 – Institution Information Security Program

Requires implementation of an institution-wide security program including monitoring, auditing, and accountability controls

• §202.75 – Managing Security Risks

Requires risk-based implementation of monitoring, detection, and response capabilities

• §202.76 – Security Control Standards Catalog

Mandates implementation of DIR-defined logging, monitoring, and audit controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)
  • AU – Audit and Accountability Control Family, including:
  • AU-2 – Event Logging
  • AU-3 – Content of Audit Records
  • AU-6 – Audit Record Review, Analysis, and Reporting
  • AU-8 – Timestamps
  • AU-9 – Protection of Audit Information
  • AU-11 – Audit Record Retention
  • AU-12 – Audit Record Generation [legalclarity.org]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.5 – Security Monitoring & Vulnerability Management Objectives, including:
  • Logging and monitoring controls
  • Detection and analysis of security events
  • Integration with incident response processes [public.powerdms.com]

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Applicable IRUSP Standards:

• Standard 17 – Security Monitoring (Primary)
• Standard 12 – Security Incident Management (Supporting)
• Standard 11 – Safeguarding Data (Supporting for protection of audit records)

These standards collectively define:

• Logging and monitoring expectations
• Detection and response processes
• Protection of security-relevant data and records

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Audit and Accountability
• Logging, monitoring, and retention of data necessary for cyber incident detection and reporting
• Preservation of audit records to support forensic analysis and reporting obligations [law.cornell.edu]

Implementation Note

Subordinate policies, standards, procedures, and system-level documentation shall:

• Define:
  • Logged event types and required log content
  • Log retention periods and storage protections
  • Review frequency and escalation procedures
  • Integration with incident response processes
• Ensure:
  • Logs are complete, accurate, and protected
  • Monitoring processes are risk-based and consistently enforced

Configuration Management (03.04.01 – 03.04.12)

Control Objective

Establish, implement, and maintain configuration management controls to ensure that CUI systems are securely configured, consistently managed, and protected against unauthorized or unmanaged changes that could impact the confidentiality, integrity, or availability of Controlled Unclassified Information (CUI).

Guidance Objectives

CUI systems shall implement and enforce the following:

• Baseline Configuration Management Establish, document, and maintain approved baseline configurations for all system components. Baselines shall be formally reviewed, approved, and maintained under configuration control.
• Secure Configuration and Hardening Implement secure configuration settings, enforce least functionality, and apply system and application hardening aligned with recognized standards and institutional requirements.
• Application Control and Allow-Listing Restrict execution of unauthorized software through application allow-listing or equivalent controls to reduce system attack surface.
• Change Management and Control Enforce formal change management processes that include:
  • Documented change requests and approvals
  • Security impact analysis prior to implementation
  • Testing and validation of changes
  • Restricted access to implement changes
• Asset and Configuration Inventory Maintain accurate, current inventories of system components, including hardware, software, and firmware. Document and track locations where CUI is stored, processed, or transmitted.
• Enhanced Configuration Controls Apply additional security controls for:
  • High-risk systems
  • Mobile or portable devices
  • Systems used in travel or remote environments

Authoritative References

The following authoritative sources define and govern configuration management requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.74 – Institution Information Security Program
  • Requires implementation of security controls including system configuration, change control, and baseline management
• §202.75 – Managing Security Risks
  • Requires risk-based configuration decisions, system hardening, and ongoing control evaluation
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined configuration management controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)
  • CM – Configuration Management Control Family, including:
  • CM-2 – Baseline Configuration
  • CM-3 – Configuration Change Control
  • CM-5 – Access Restrictions for Change
  • CM-6 – Configuration Settings (System Hardening)
  • CM-7 – Least Functionality
  • CM-8 – System Component Inventory
  • CM-11 – User-Installed Software / Allow-Listing Controls

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.2 – Asset Management Objectives
  • Inventory and lifecycle management of system components
  • Section 4.3 – System Development & Maintenance Objectives
  • Configuration management, system hardening, and change control processes
  • Section 4.5 – Security Monitoring & Vulnerability Management Objectives (Supporting)
  • Monitoring for unauthorized or improper configuration changes

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

• IRUSP Policy https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 7 – Change Management (Primary)
• Standard 19 – Server and Device Configuration and Management (Primary)
• Standard 10 – Risk Management (Supporting)
• Standard 11 – Safeguarding Data (Supporting – protection of CUI locations)

These standards collectively define:

• Configuration baseline control and maintenance
• Change approval, tracking, and enforcement
• System hardening and device-level configuration requirements
• Risk-informed configuration decisions

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Configuration Management
• Maintenance of secure system configurations and controlled changes
• Protection of systems handling Covered Defense Information (CDI) from misconfiguration and unauthorized modification [law.cornell.edu]

Implementation Note

Subordinate policies, standards, procedures, and system-level documentation shall:

• Define:
  • Approved baseline configurations and configuration standards
  • Change control workflows and approval authorities
  • System inventory requirements and maintenance processes
  • Controls for software installation and execution
• Ensure:
  • Configurations are secure, standardized, and continuously monitored
  • Changes are authorized, tracked, and validated
  • Documentation supports audit, compliance, and CMMC Level 2 validation

Identification and Authentication (03.05.01 – 03.05.12)

Control Objective

Establish, implement, and maintain identification and authentication controls to ensure that users, devices, and processes are uniquely identified and securely authenticated prior to accessing CUI systems and Controlled Unclassified Information (CUI), in accordance with institutional, state, and federal requirements.

Guidance Objectives

CUI systems shall implement and enforce the following:

• Identity Management and Unique Identification Require unique identifiers for all users, devices, and system components. Ensure that all identities are managed throughout their lifecycle, including provisioning, modification, and deprovisioning.
• Authentication Mechanisms and Enforcement Authenticate all users and devices prior to granting access to systems and CUI using approved authentication mechanisms aligned with institutional and regulatory requirements.
• Multifactor authentication (MFA) Enforce MFA for:
  • Privileged accounts
  • Remote access
  • High-risk or sensitive operations
• Replay-Resistant Authentication Implement replay-resistant authentication mechanisms (e.g., cryptographic protocols, time-based tokens) where applicable to protect against credential replay attacks.
• Authenticator and Credential Protection Protect authentication secrets (e.g., passwords, private keys, tokens) through secure storage, transmission, and handling practices. Enforce lifecycle management including:
  • Creation and distribution
  • Rotation and expiration
  • Revocation and deactivation
• Authentication Feedback and Information Protection Limit authentication error messages and system feedback to prevent disclosure of sensitive system or account information.

Authoritative References

The following authoritative sources define and govern identification and authentication requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires formal identification of users, assignment of responsibilities, and approval of access to information resources
• §202.74 – Institution Information Security Program
  • Requires implementation of authentication and access control safeguards across institutional systems
• §202.75 – Managing Security Risks
  • Requires risk-based authentication controls and identity protection mechanisms
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR identification and authentication controls
• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
  • Establishes authentication and access requirements for cloud-based systems

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)
  • IA – Identification and Authentication Control Family, including:
  • IA-2 – Identification and Authentication (Users)
  • IA-3 – Device Identification and Authentication
  • IA-5 – Authenticator Management (passwords, keys, tokens)
  • IA-7 – Cryptographic Module Authentication
  • IA-8 – Network-Based Authentication (including MFA use cases)

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.1 – Access Management Objectives, including:
  • Identity lifecycle management
  • Authentication and authorization controls
  • Federation and credential management requirements

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

• IRUSP Policy https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 4 – Access Management (Supporting identity lifecycle)
• Standard 5 – Administrative/Special Access Accounts (Privileged identity controls)
• Standard 15 – Passwords (Primary for authentication and credential protection)
• Standard 19 – Server and Device Configuration and Management (Device authentication context)

These standards collectively define:

• Identity lifecycle and account management
• Credential strength and protection
• Privileged identity controls
• Authentication mechanisms and enforcement requirements

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Identification and Authentication
• Enforcement of secure authentication mechanisms as part of providing “adequate security” for systems handling Controlled Unclassified Information (CUI)

Implementation Note

Subordinate policies, standards, procedures, and system-level documentation shall:

• Define:
  • Identity lifecycle processes
  • Authenticator management requirements
  • MFA enforcement criteria
  • Credential protection mechanisms
• Ensure:
  • Identities are unique, traceable, and properly managed
  • Authentication mechanisms are secure, enforced, and risk-based
  • Artifacts support audit, compliance, and CMMC Level 2 validation

Incident Response (03.06.01 – 03.06.05)

Control Objective

Establish, implement, and maintain an incident response capability to ensure timely identification, reporting, containment, eradication, and recovery from security incidents affecting CUI systems and Controlled Unclassified Information (CUI), in accordance with institutional, state, federal, and contractual requirements.

Guidance Objectives

CUI systems shall implement and enforce the following:

Incident Response Program

• Establish and maintain a formal, documented incident response program that includes:
  • Preparation and readiness activities
  • Detection and analysis of security events and incidents
  • Containment strategies to limit impact
  • Eradication of root causes
  • Recovery and restoration of normal operations
• Ensure the program is aligned with institutional risk management and security monitoring capabilities.

Incident Reporting and Escalation

• Define, document, and implement incident reporting procedures that include:
  • Internal reporting requirements and escalation thresholds
  • Notification of institutional stakeholders and leadership
  • Compliance with state, federal, and contractual reporting obligations
• Ensure timely reporting of incidents involving:
  • Unauthorized disclosure or compromise of CUI
  • Significant system disruptions or security events
  • Incidents requiring regulatory notification

Incident Response Training and Exercises

• Provide incident response training to personnel with incident handling responsibilities
• Conduct periodic testing and exercises (e.g., tabletop, simulation, and functional exercises) to validate:
  • Roles and responsibilities
  • Communication and escalation procedures
  • Response effectiveness and readiness

Incident Response Plan and Governance

• Develop, maintain, and protect an Incident Response Plan (IRP) that defines:
  • Roles and responsibilities (e.g., incident response team, CISO, system owners)
  • Incident classification and severity levels
  • Reportable incident criteria
  • Communication and coordination processes
• Ensure the IRP is:
  • Reviewed and updated periodically
  • Accessible to authorized personnel
  • Protected from unauthorized modification or disclosure

Authoritative References

The following authoritative sources define and govern incident response requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.73 – Security Reporting
  • Requires institutions to report on security program effectiveness and submit formal security plans and assessments [SECTION 20...e of Texas]
• §202.74 – Institution Information Security Program
  • Requires implementation of an institution-wide security program, including incident response capabilities
• §202.75 – Managing Security Risks
  • Requires risk-based processes for detection, response, and mitigation of security events
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined incident response controls

Texas Department of Information Resources (DIR)

DIR Security Control Standards Catalog (mandated by TAC §202.76)

IR – Incident Response Control Family, including:

• IR-1 – Incident Response Policy and Procedures
• IR-2 – Incident Response Training
• IR-3 – Incident Response Testing
• IR-4 – Incident Handling (detection, containment, eradication, recovery)
• IR-5 – Incident Monitoring
• IR-6 – Incident Reporting
• IR-7 – Incident Response Assistance
• IR-8 – Incident Response Plan

These controls define the mandatory baseline requirements for incident response across Texas higher education institutions. [dir.texas.gov]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.6 – Incident Management Objectives, including:
  • Incident detection, handling, and response
  • Coordination with monitoring and reporting processes
  • Integration with institutional risk management and compliance requirements [utsystem.edu]

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 12 – Security Incident Management (Primary)
• Standard 17 – Security Monitoring (Supporting detection and escalation)
• Standard 10 – Risk Management (Supporting governance and response prioritization)

These standards collectively define:

• Incident detection, reporting, and response requirements
• Integration with monitoring and risk management processes
• Institutional responsibilities for incident handling

Federal and Contractual Requirements

DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 incident response controls
• Reporting of cyber incidents within 72 hours to the Department of Defense
• Preservation of affected systems and audit data for forensic analysis
• Flow-down of incident reporting requirements to subcontractors

Maintenance (03.07.04 – 03.07.06)

Control Objective

Establish, implement, and maintain maintenance controls to ensure that system maintenance activities are authorized, controlled, and monitored in a manner that protects the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI) and CUI systems.

Guidance Objectives

CUI systems shall implement and enforce the following:

• Maintenance Tools and Media Control
  • Authorize, inventory, and control the use of maintenance tools, including diagnostic and administrative utilities.
  • Scan and validate all media (e.g., removable storage, tools, firmware updates) for malicious content prior to use on CUI systems.
  • Restrict use of maintenance tools to authorized personnel and approved use cases.
• Remote Maintenance Controls
  • Restrict remote maintenance activities to approved methods and authorized personnel.
  • Enforce secure authentication mechanisms (including MFA where applicable) for remote maintenance sessions.
  • Monitor all remote maintenance activity and:
  • Log session activity
  • Terminate sessions immediately upon completion
  • Disable remote access mechanisms when not actively in use
• Personnel Authorization and Oversight
  • Ensure that all maintenance personnel, including third-party vendors and contractors:
  • Are properly vetted and authorized prior to access
  • Are granted only the minimum access necessary
  • Are supervised or monitored when performing maintenance activities on CUI systems
  • Enforce formal authorization and approval processes for all maintenance activities.

Authoritative References

The following authoritative sources define and govern maintenance control requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires identification, authorization, and accountability of individuals with access to information resources
• §202.74 – Institution Information Security Program
  • Requires implementation of security controls governing system operation, maintenance, and protection
• §202.75 – Managing Security Risks
  • Requires risk-based controls for system operations, including maintenance and external access
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined maintenance and access control requirements
• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
  • Applies to cloud and third-party environments, including vendor maintenance and remote access controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

MA – Maintenance Control Family, including:

• MA-2 – Controlled Maintenance
• MA-3 – Maintenance Tools
• MA-4 – Nonlocal (Remote) Maintenance
• MA-5 – Maintenance Personnel

These controls define:

• Authorization and tracking of maintenance activities
• Control of tools and diagnostic capabilities
• Secure execution of remote maintenance
• Requirements for personnel authorization and oversight

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.3 – System Development & Maintenance Objectives, including:
  • Secure system maintenance practices
  • Change and configuration control integration
  • Protection of systems during maintenance activities

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 19 – Server and Device Configuration and Management (Primary)
• Standard 7 – Change Management (Supporting)
• Standard 22 – Vendor and Third-Party Controls and Compliance (Supporting)

These standards collectively define:

• System maintenance and configuration management practices
• Control and authorization of system changes and updates
• Oversight of third-party maintenance personnel and activities

Federal and Contractual Requirements

DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Maintenance
• Protection of systems handling CUI during operational and maintenance activities
• Enforcement of access controls and monitoring during remote or third-party maintenance

Media Protection (03.08.01 – 03.08.09)

Guidance Objectives

• Securely store, access, mark, transport, and sanitize media containing CUI.
• Restrict media access to authorized personnel and maintain inventories.
• Enforce cryptographic protection for backups and media where applicable.
• Apply NIST-aligned sanitization prior to reuse or disposal.

Authoritative References

• TAC 202 Subchapter C: §§202.72(a)(1)– (2), 202.74(a), 202.76(b), 202.28
• DIR Media Protection and Sanitization Guidance
• UTS Policy 165.7

Personnel Security (03.09.01 – 03.09.02)

Control Objective

Establish, implement, and maintain personnel security controls to ensure that individuals with access to CUI systems and Controlled Unclassified Information (CUI) are appropriately screened, authorized, and managed throughout their lifecycle, and that access is promptly adjusted or revoked upon changes in employment or role.

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Personnel Screening and Authorization

• Conduct risk-based personnel screening prior to granting access to:
  • CUI systems
  • CUI or other sensitive information
• Screening requirements shall be:
  • Commensurate with the level of access and sensitivity of data
  • Applied to employees, contractors, consultants, and third-party personnel
• Ensure individuals are formally authorized prior to being granted system or data access.

Personnel Transfer and Termination Controls

• Implement processes to promptly modify or revoke access when personnel:
  • Transfer roles
  • Change responsibilities
  • Terminate employment or contractual engagement
• Ensure:
  • Access privileges are adjusted based on new role requirements
  • Accounts are disabled or removed in a timely manner
  • Credentials, devices, and media are returned or revoked as appropriate

Accountability and Coordination

• Ensure coordination between:
  • Human resources
  • Information security
  • System owners
• Maintain documentation and audit trails demonstrating:
  • Personnel authorization
  • Access provisioning and revocation actions
  • Compliance with institutional and regulatory requirements

Authoritative References

The following authoritative sources define and govern personnel security requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires designation of roles (owners, custodians, users) and accountability for access to information resources
• §202.74 – Institution Information Security Program
  • Requires implementation of safeguards governing personnel responsibilities and access control
• §202.75 – Managing Security Risks
  • Requires risk-based controls, including personnel-related risk considerations

Texas Department of Information Resources (DIR)

DIR Security Control Standards Catalog (mandated by TAC §202.76)

PS – Personnel Security Control Family, including:

• PS-2 – Position Risk Designation
• PS-3 – Personnel Screening
• PS-4 – Personnel Termination
• PS-5 – Personnel Transfer

These controls define:

• Screening requirements based on role sensitivity
• Termination and transfer procedures for access management
• Personnel-related accountability and risk management

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.3 – Personnel & Third-Party Security Objectives, including:
  • Personnel screening and authorization
  • Management of personnel access throughout lifecycle
  • Third-party personnel security alignment

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 1 – Information Resources Security Responsibilities and Accountability (Primary)
• Standard 4 – Access Management (Supporting lifecycle access control)
• Standard 22 – Vendor and Third-Party Controls and Compliance (Supporting third-party personnel)

These standards collectively define:

• Personnel accountability and responsibilities
• Access lifecycle management
• Third-party personnel access governance

Federal and Contractual Requirements

DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Personnel Security
• Enforcement of controls to ensure only authorized personnel access CUI
• Flow-down of personnel security requirements to subcontractors handling CUI

Physical Protection (03.10.01 – 03.10.08)

Control Objective

Establish, implement, and maintain physical protection controls to prevent unauthorized physical access, damage, or interference to CUI systems, facilities, and infrastructure supporting Controlled Unclassified Information (CUI).

Guidance Objectives

CUI systems and facilities shall implement and enforce the following:

Physical Access Authorization and Control

• Enforce physical access controls through:
  • Authorization mechanisms (e.g., badges, biometrics, keys)
  • Credential issuance, management, and revocation
  • Approved access lists for facilities and restricted areas
• Ensure access is limited to authorized personnel based on role and need.

Visitor Management and Logging

• Implement formal visitor management procedures including:
  • Visitor authorization and registration
  • Escort requirements for non-authorized individuals
  • Logging of visitor access and activities
• Maintain access logs for physical entry and exit to support accountability and investigations.

Monitoring and Incident Response

• Monitor physical access points and sensitive areas using:
  • Surveillance systems
  • Access control systems
  • Guard services or automated monitoring
• Detect, investigate, and respond to unauthorized or suspicious physical access events.

Alternate Work Sites and Telework Security

• Define and enforce physical security requirements for:
  • Alternate work locations (e.g., remote offices, field sites)
  • Telework environments
• Ensure that CUI is protected from unauthorized access in non-institutional environments through appropriate safeguards.

Physical Infrastructure Protection

• Secure physical transmission and distribution systems, including:
  • Cabling and network infrastructure
  • Power and environmental systems
  • Data center and communications facilities
• Prevent unauthorized access, tampering, or disruption of supporting infrastructure.

Authoritative References

The following authoritative sources define and govern physical protection requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires designation and accountability of personnel responsible for protecting information resources and facilities
• §202.73 – Security Reporting
  • Supports reporting of security incidents, including physical security events [txrules.elaws.us]
• §202.74 – Institution Information Security Program
  • Requires implementation of security controls, including physical and environmental protections
• §202.75 – Managing Security Risks
  • Requires risk-based evaluation and implementation of physical and environmental safeguards
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined physical protection controls

Texas Department of Information Resources (DIR)

DIR Security Control Standards Catalog (mandated by TAC §202.76)

PE – Physical and Environmental Protection Control Family, including:

• PE-2 – Physical Access Authorizations
• PE-3 – Physical Access Control
• PE-6 – Monitoring Physical Access
• PE-8 – Visitor Access Records
• PE-9 – Power Equipment and Cabling Protection
• PE-18 – Location of Information Systems
• PE-19 – Information Leakage Controls

These controls define:

• Physical access restrictions and credentialing
• Visitor management and logging
• Monitoring and incident detection
• Protection of facilities and supporting infrastructure [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.3 – Information Security Physical & Environmental Policy
  • Section 4.1 – Physical and Environmental Security Objectives, including:
  • Physical access control and facility protection
  • Access provisioning, monitoring, and revocation
  • Protection of IT facilities and infrastructure

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 16 – Data Center Security (Primary)
• Standard 19 – Server and Device Configuration and Management (Supporting)
• Standard 1 – Information Resources Security Responsibilities and Accountability (Supporting)

These standards collectively define:

• Physical security requirements for data centers and facilities
• Protection of systems and devices in controlled environments
• Personnel accountability for physical protection

Federal and Contractual Requirements

DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Physical Protection
• Protection of systems and facilities processing, storing, or transmitting Controlled Unclassified Information (CUI)
• Safeguards to prevent unauthorized physical access or compromise

Risk Assessment (03.11.01 – 03.11.04)

Control Objective

Establish, implement, and maintain a risk assessment capability to identify, evaluate, and manage risks to CUI systems and Controlled Unclassified Information (CUI), including risks arising from supply chain dependencies, in accordance with institutional, state, federal, and contractual requirements.

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Risk Assessment Program

• Conduct periodic, risk-based assessments of information systems, environments, and processes to:
  • Identify threats, vulnerabilities, and potential impacts
  • Evaluate risks to confidentiality, integrity, and availability of CUI
  • Include supply chain and third-party risks where applicable
• Ensure risk assessments are:
  • Performed at defined intervals
  • Updated based on significant changes to systems or environments
  • Documented and approved by appropriate stakeholders

Risk Response and Mitigation

• Develop and implement risk response strategies, including:
  • Risk mitigation (controls implementation)
  • Risk acceptance (with documented justification)
  • Risk transfer or avoidance where appropriate
• Document:
  • Identified risks and associated impact levels
  • Selected mitigation strategies and control implementations
  • Residual risk decisions and formal acceptance by authorized officials

Continuous Risk Monitoring

• Integrate risk assessment results into:
  • Security control selection and implementation
  • Configuration management and change control processes
  • Incident response and monitoring activities
• Ensure risks are continuously evaluated and updated based on:
  • Emerging threats
  • System changes
  • External dependencies

Authoritative References

The following authoritative sources define and govern risk assessment requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.75 – Managing Security Risks
  • Requires institutions to implement formal risk management processes, including identification and mitigation of risks
• §202.74 – Institution Information Security Program
  • Requires risk-based implementation of security controls within an institutional security program
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined risk assessment and management controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

RA – Risk Assessment Control Family, including:

• RA-3 – Risk Assessment
• RA-5 – Vulnerability Monitoring and Scanning
• RA-7 – Risk Response

These controls define:

• Identification and evaluation of system risks
• Vulnerability assessment and analysis
• Development and implementation of mitigation strategies
• Documentation and management of residual risk

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.2 – Cybersecurity Risk Management Objectives, including:
  • Risk identification and assessment
  • Risk treatment and management
  • Integration of risk management into institutional governance
• UTS 165.2 – Information Security Technology Policy (Supporting)
  • Supports implementation of risk-based controls across systems and infrastructure

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 10 – Risk Management (Primary)
• Standard 22 – Vendor and Third-Party Controls and Compliance (Supporting supply chain risk)
• Standard 3 – Information Security Programs (Supporting governance and integration)

These standards collectively define:

• Institutional risk management framework
• Assessment and mitigation processes
• Third-party and supply chain risk considerations

Federal and Contractual Requirements

DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Risk Assessment
• Identification and mitigation of risks to systems handling Controlled Unclassified Information (CUI)
• Continuous evaluation of system security posture and vulnerabilities

Security Assessment (03.12.01 – 03.12.05)

Control Objective

Establish, implement, and maintain a security assessment capability to evaluate the effectiveness of security controls, identify weaknesses, and ensure continuous monitoring and improvement of CUI systems handling Controlled Unclassified Information (CUI).

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Security Assessment Planning and Execution

• Develop and maintain a security assessment plan that defines:
  • Scope and objectives of assessments
  • Assessment methodologies and frequency
  • Roles and responsibilities
• Perform periodic security assessments to:
  • Evaluate control effectiveness
  • Validate compliance with institutional, state, and federal requirements
  • Identify weaknesses, deficiencies, and gaps

Plans of Action and Milestones (POA&Ms)

• Document identified deficiencies in formal Plans of Action and Milestones (POA&Ms).
• Define:
  • Corrective actions and remediation steps
  • Responsible parties
  • Timelines and milestones
• Track POA&M items through remediation and closure, including validation of corrective actions.

Continuous Monitoring

• Implement continuous monitoring capabilities to:
  • Track ongoing control effectiveness
  • Detect changes in system security posture
  • Support risk-based decision-making
• Integrate monitoring with:
  • Logging and audit processes
  • Vulnerability management
  • Incident response

Information Exchange and Interconnection Security

• Manage and document all system interconnections and information exchanges through:
  • Formal agreements (e.g., Interconnection Security Agreements, MOUs, contracts)
  • Defined security requirements for external systems
• Ensure that interconnections:
  • Are authorized and documented
  • Meet security requirements consistent with CUI protection obligations

Authoritative References

The following authoritative sources define and govern security assessment and continuous monitoring requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.73 – Security Reporting
  • Requires submission of security plans and assessments and reporting on security posture [txrules.elaws.us]
• §202.74 – Institution Information Security Program
  • Requires implementation of a comprehensive security program, including assessment and monitoring
• §202.75 – Managing Security Risks
  • Requires ongoing evaluation of risks and effectiveness of controls
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined assessment and monitoring controls
• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
  • Establishes requirements for authorization, assessment, and monitoring of cloud services

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

CA – Assessment, Authorization, and Monitoring Control Family, including:

• CA-2 – Security Assessments
• CA-5 – Plan of Action and Milestones (POA&M)
• CA-6 – Authorization
• CA-7 – Continuous Monitoring
• CA-3 – System Interconnections and Information Exchange

These controls define:

• Formal assessment planning and execution
• POA&M tracking and remediation
• Ongoing monitoring and authorization processes
• Management of system interconnections and data exchange

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.2 – Cybersecurity Risk Management Objectives, including:
  • Assessment of security controls
  • Risk evaluation and mitigation
  • Continuous improvement processes
• UTS 165.2 – Information Security Technology Policy
  • Section 4.5 – Security Monitoring & Vulnerability Management Objectives, including:
  • Continuous monitoring of system security
  • Identification of weaknesses and vulnerabilities
  • Integration with assessment and remediation processes

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 3 – Information Security Programs (Primary)
• Standard 17 – Security Monitoring (Supporting)
• Standard 12 – Security Incident Management (Supporting continuous improvement)

These standards collectively define:

• Assessment and evaluation of security controls
• Continuous monitoring and feedback mechanisms
• Integration with incident detection and response processes

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Security Assessment
• Documentation and tracking of control effectiveness and deficiencies (e.g., POA&M)
• Ongoing monitoring and assessment of systems handling Controlled Unclassified Information (CUI)

System and Communications Protection (03.13.01 – 03.13.16)

Control Objective

Establish, implement, and maintain system and communications protection controls to safeguard the transmission, processing, and storage of Controlled Unclassified Information (CUI) by protecting system boundaries, enforcing secure communications, and applying cryptographic protections in accordance with institutional, state, federal, and contractual requirements.

Guidance Objectives

CUI systems shall implement and enforce the following:

Boundary Protection and Network Security

• Protect system boundaries using layered security controls, including:
  • Network segmentation and isolation
  • Firewalls and access control devices
  • Intrusion detection and prevention systems
• Enforce default-deny network configurations, allowing only explicitly authorized traffic and services.
• Monitor network traffic and system boundaries to detect and respond to unauthorized or anomalous activity.

Secure Communications and Data Protection

• Protect CUI in transit using approved cryptographic mechanisms (e.g., TLS, IPsec).
• Ensure communications are authenticated, encrypted, and integrity-protected.
• Prevent unauthorized disclosure or interception of sensitive data across networks.

Cryptographic Protection and Key Management

• Enforce cryptographic protection for:
  • CUI at rest (where applicable)
  • Backup systems and storage media
  • Communications channels
• Manage cryptographic keys through formal processes, including:
  • Secure generation and distribution
  • Storage and rotation
  • Revocation and destruction

Secure Use of Communications Technologies

• Secure collaborative tools, shared systems, and communication platforms to prevent unauthorized access or disclosure of CUI.
• Implement controls for:
  • Mobile code (e.g., scripts, applets)
  • Shared resources (e.g., file shares, collaboration platforms)
  • Session integrity and confidentiality
• Ensure session protections include:
  • Encryption
  • Session validation and integrity
  • Protection against session hijacking or interception

Network Access and Resource Protection

• Restrict and monitor use of shared system resources and communication pathways.
• Prevent unauthorized connections to external systems and networks.
• Ensure that all communications interfaces are managed, documented, and secured.

Authoritative References

The following authoritative sources define and govern system and communications protection requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires accountability and authorization for users handling system and communication resources
• §202.74 – Institution Information Security Program
  • Requires implementation of safeguards to protect systems and communications
• §202.75 – Managing Security Risks
  • Requires risk-based protection of networks, communications, and data flows
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined system and communications protection controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

SC – System and Communications Protection Control Family, including:

• SC-7 – Boundary Protection
• SC-8 – Transmission Confidentiality and Integrity
• SC-12 / SC-13 – Cryptographic Key Establishment and Protection
• SC-16 – Transmission of Security Attributes
• SC-18 – Mobile Code
• SC-19 – Voice Over IP / Communications Protection
• SC-28 – Protection of Information at Rest

These controls define:

• Network boundary protections and segmentation
• Cryptographic protections for data in transit and at rest
• Secure communications and session protections
• Protection of shared and distributed communication resources [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.1 – Access Management Objectives (Supporting network access restrictions)
  • Section 4.3 – System Development & Maintenance Objectives (Supporting system hardening and segmentation)
  • Section 4.5 – Security Monitoring & Vulnerability Management Objectives, including:
  • Monitoring of network traffic and communications
  • Detection of unauthorized or anomalous activity

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 11 – Safeguarding Data (Primary – encryption and protection of CUI)
• Standard 19 – Server and Device Configuration and Management (Supporting system configuration and communications security)
• Standard 22 – Vendor and Third-Party Controls and Compliance (Supporting external system communications)

These standards collectively define:

• Protection of data in transit and at rest
• Secure system and device configurations
• Controls for external communications and integrations

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including System and Communications Protection
• Protection of CUI during transmission and storage
• Use of cryptographic safeguards and secure communications mechanisms
• Enforcement of network security and boundary protection controls

System and Information Integrity (03.14.01 – 03.14.08)

Control Objective

Establish, implement, and maintain system and information integrity controls to ensure that CUI systems and Controlled Unclassified Information (CUI) are protected from unauthorized modification, corruption, and malicious activity, and that vulnerabilities and threats are identified, managed, and remediated in a timely manner.

Guidance Objectives

CUI systems shall implement and enforce the following:

Vulnerability and Flaw Management

• Identify, assess, and remediate system flaws and vulnerabilities in a timely manner, including:
  • Application of security patches and updates
  • Configuration corrections
  • Vendor-provided security advisories
• Track vulnerabilities through formal processes, including:
  • Prioritization based on risk and impact
  • Documented remediation timelines
  • Verification of remediation effectiveness

Malware Protection

• Deploy and maintain malware protection mechanisms across systems and endpoints, including:
  • Anti-malware/endpoint protection tools
  • Real-time scanning capabilities
  • Automated updates for detection signatures
• Monitor systems for malicious code and take appropriate actions to:
  • Detect and quarantine threats
  • Prevent execution of unauthorized or malicious software

System Monitoring and Integrity Checking

• Implement continuous monitoring mechanisms to:
  • Detect unauthorized changes to systems or data
  • Identify anomalous behavior or integrity violations
  • Validate system and file integrity
• Integrate monitoring with:
  • Logging and audit systems
  • Incident response processes
  • Security information and event management (SIEM) capabilities

Security Alert and Advisory Response

• Establish processes to receive, evaluate, and respond to:
  • Security alerts and vulnerability advisories (e.g., vendor, government sources)
  • Threat intelligence feeds
• Ensure timely response actions, including:
  • Risk evaluation
  • Mitigation or remediation activities
  • Communication to stakeholders

Information Retention and Integrity

• Manage information retention in accordance with:
  • Legal and regulatory requirements
  • Institutional policies and data classification standards
• Ensure integrity and availability of retained information through:
  • Protection against unauthorized modification or deletion
  • Monitoring of data storage environments
  • Secure archival and disposal processes

Authoritative References

The following authoritative sources define and govern system and information integrity requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.73 – Security Reporting
  • Supports reporting and oversight of security posture and incidents [txrules.elaws.us]
• §202.74 – Institution Information Security Program
  • Requires implementation of safeguards to maintain system integrity and security
• §202.75 – Managing Security Risks
  • Requires identification, evaluation, and mitigation of risks, including vulnerabilities
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined integrity and security controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

SI – System and Information Integrity Control Family, including:

• SI-2 – Flaw Remediation
• SI-3 – Malicious Code Protection
• SI-4 – System Monitoring
• SI-5 – Security Alerts and Advisories
• SI-7 – Software, Firmware, and Information Integrity

These controls define:

• Identification and remediation of system vulnerabilities
• Malware detection and prevention requirements
• Continuous system monitoring and integrity validation
• Response to security advisories and threat intelligence [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.5 – Security Monitoring & Vulnerability Management Objectives, including:
  • Vulnerability identification and remediation
  • Malware protection and system monitoring
  • Detection of integrity violations
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy (Supporting)
  • Provides governance for risk management and security oversight

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 17 – Security Monitoring (Primary)
• Standard 12 – Security Incident Management (Supporting response activities)
• Standard 11 – Safeguarding Data (Supporting data integrity and protection)

These standards collectively define:

• Monitoring and detection of anomalies and threats
• Response to incidents and integrity violations
• Protection of information throughout its lifecycle

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including System and Information Integrity
• Timely identification and remediation of vulnerabilities
• Protection of systems from malicious activity and unauthorized modification
• Monitoring and response capabilities to maintain system integrity

Planning (03.15.01 – 03.15.03)

Control Objective

Establish, implement, and maintain planning controls to ensure that CUI systems and Controlled Unclassified Information (CUI) are governed by comprehensive, documented, and approved security policies, procedures, and system-level planning artifacts that define and enforce security requirements.

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Security Policies and Procedures

• Develop, document, and maintain institutional security policies and procedures that:
  • Define security objectives, requirements, and responsibilities
  • Address protection of CUI and CUI systems
  • Align with applicable regulatory and contractual obligations
• Ensure policies and procedures are:
  • Approved by appropriate governance authorities
  • Reviewed and updated periodically
  • Communicated to all relevant personnel

System Security Plan (SSP)

• Develop and maintain a System Security Plan (SSP) for each CUI system that:
  • Describes system architecture, boundaries, and components
  • Documents implemented security controls and control inheritance
  • Identifies roles, responsibilities, and control ownership
• Ensure the SSP:
  • Is kept current and reflects the actual system environment
  • Is reviewed and updated following significant system or control changes
  • Supports risk management, assessment, and audit processes

Rules of Behavior

• Establish, document, and enforce Rules of Behavior (RoB) for system users that define:
  • Acceptable use of information resources
  • Responsibilities for protecting CUI
  • Prohibited activities and misuse
• Require users to:
  • Acknowledge and accept Rules of Behavior prior to access
  • Comply with institutional policies and security requirements

Integration with Risk and Compliance

• Ensure planning artifacts (policies, SSPs, RoB) are integrated with:
  • Risk assessment and management processes
  • Security assessment and authorization activities
  • Incident response and monitoring capabilities
• Maintain documentation sufficient to support:
  • Audit and compliance validation
  • Continuous monitoring and improvement

Authoritative References

The following authoritative sources define and govern planning and security documentation requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.72 – Staff Responsibilities
  • Requires definition of roles, responsibilities, and accountability for information security
• §202.74 – Institution Information Security Program
  • Requires establishment and maintenance of a formal information security program, including policies and procedures
• §202.75 – Managing Security Risks
  • Requires integration of planning activities with risk management processes
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined planning and governance controls

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

PL – Planning Control Family, including:

• PL-1 – Security Planning Policy and Procedures
• PL-2 – System Security Plan
• PL-4 – Rules of Behavior
• PL-8 – Information Security Architecture

These controls define:

• Development and maintenance of security policies and procedures
• Requirements for SSP documentation and maintenance
• Rules of Behavior and acceptable use expectations
• Integration of planning with system architecture and security design [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.1 – Information Security Governance Objectives, including:
  • Establishment and maintenance of security policies and procedures
  • Governance of institutional security programs
  • Definition of roles, responsibilities, and compliance expectations

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 3 – Information Security Programs (Primary)
• Standard 2 – Acceptable Use of Information Resources (Rules of Behavior alignment)
• Standard 1 – Information Resources Security Responsibilities and Accountability (Supporting governance)

These standards collectively define:

• Institutional security program structure and requirements
• Acceptable use and user behavior expectations
• Governance and accountability responsibilities

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Planning
• Development and maintenance of System Security Plans (SSPs)
• Documentation of implemented controls and system security posture for systems handling CUI

System and Services Acquisition (03.16.01 – 03.16.03)

Control Objective

Establish, implement, and maintain system and services acquisition controls to ensure that security requirements are incorporated throughout the lifecycle of system development, acquisition, and external service use, thereby protecting Controlled Unclassified Information (CUI) and CUI systems.

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Secure System Development and Acquisition

• Apply security engineering principles and best practices throughout:
  • System development lifecycles (SDLC)
  • System acquisition and procurement processes
  • Integration and deployment of systems and services
• Ensure that security requirements are:
  • Defined early in the lifecycle
  • Evaluated during design and development
  • Tested prior to production deployment

Component Lifecycle and Unsupported Systems

• Identify and manage system components that reach end-of-life or become unsupported.
• Ensure such components are:
  • Replaced with supported alternatives, or
  • Mitigated through compensating controls
• Maintain visibility into component lifecycle status, including:
  • Software versions
  • Vendor support timelines
  • Patch and update availability

Contractual Security Requirements

• Incorporate security and privacy requirements into contracts, procurements, and acquisition agreements, including:
  • Protection of CUI
  • Compliance with applicable regulations (e.g., NIST 800-171)
  • Incident reporting expectations
  • Flow-down of security requirements to subcontractors
• Ensure procurement processes include security review and approval prior to acquisition.

External Service Provider Management

• Monitor and manage external service providers (e.g., cloud providers, vendors, contractors) to ensure:
  • Ongoing compliance with security requirements
  • Adherence to contractual obligations
  • Protection of CUI and institutional systems
• Establish processes for:
  • Vendor risk assessment
  • Continuous monitoring of provider security posture
  • Periodic review of service agreements

Authoritative References

The following authoritative sources define and govern system and services acquisition requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.74 – Institution Information Security Program
  • Requires implementation of security controls across systems and services
• §202.75 – Managing Security Risks
  • Requires risk-based decision-making, including procurement and third-party risk
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined acquisition and system lifecycle controls
• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
  • Establishes requirements for cloud service providers, including authorization, monitoring, and compliance

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

SA – System and Services Acquisition Control Family, including:

• SA-3 – System Development Lifecycle
• SA-4 – Acquisition Process
• SA-5 – System Documentation
• SA-9 – External System Services
• SA-10 – Developer Configuration Management
• SA-11 – Developer Testing and Evaluation

These controls define:

• Secure system development and acquisition requirements
• Integration of security into procurement processes
• Vendor and external service provider security requirements
• Ongoing evaluation and oversight of acquired systems [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.2 – Information Security Technology Policy
  • Section 4.3 – System Development & Maintenance Objectives, including:
  • Security integration in development and acquisition
  • Lifecycle management of systems and components
  • Section 4.2 – Asset Management Objectives (Supporting lifecycle tracking and inventory)

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 22 – Vendor and Third-Party Controls and Compliance (Primary)
• Standard 19 – Server and Device Configuration and Management (Supporting)
• Standard 10 – Risk Management (Supporting vendor risk integration)

These standards collectively define:

• Vendor and third-party security requirements
• Acquisition and lifecycle control expectations
• Risk-based evaluation of external services

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including System and Services Acquisition
• Inclusion of flow-down security requirements to subcontractors handling Covered Defense Information (CDI)
• Enforcement of contractual obligations for protecting CUI across external systems and services
• Reporting and compliance obligations for third-party providers

Supply Chain Risk Management (03.17.01 – 03.17.03)

Control Objective

Establish, implement, and maintain a Supply Chain Risk Management (SCRM) capability to identify, assess, and mitigate risks associated with the acquisition, development, integration, and operation of system components, products, and services that support CUI systems and Controlled Unclassified Information (CUI).

Guidance Objectives

CUI systems and supporting organizations shall implement and enforce the following:

Supply Chain Risk Management Program

• Establish and maintain a formal Supply Chain Risk Management (SCRM) program that:
  • Identifies risks associated with suppliers, vendors, and service providers
  • Evaluates supply chain threats, vulnerabilities, and dependencies
  • Integrates supply chain considerations into enterprise risk management
• Ensure the SCRM program:
  • Is documented, approved, and periodically reviewed
  • Aligns with institutional risk management and acquisition processes
  • Includes both hardware and software supply chains

Acquisition and Procurement Risk Mitigation

• Apply acquisition strategies to reduce supply chain risk, including:
  • Vendor due diligence and risk assessments
  • Evaluation of supplier security posture and history
  • Preference for vetted, authorized, and trusted sources
• Incorporate supply chain risk considerations into:
  • Procurement decisions
  • System architecture and design
  • Lifecycle management of components and services

Contractual Enforcement and Vendor Oversight

• Enforce supply chain security requirements contractually, including:
  • Protection of CUI
  • Compliance with NIST SP 800-171 and applicable standards
  • Incident reporting and notification obligations
  • Flow-down of requirements to subcontractors
• Establish processes to:
  • Monitor vendor compliance with contractual security obligations
  • Conduct periodic reviews and reassessments of suppliers
  • Address non-compliance through corrective actions

Continuous Monitoring and Supply Chain Visibility

• Maintain visibility into supply chain components and dependencies, including:
  • Software, firmware, and hardware sources
  • Third-party service providers and cloud services
  • Subcontractors and downstream providers
• Implement monitoring processes to:
  • Detect supply chain-related risks or changes
  • Assess impacts on system security posture
  • Support continuous risk management and response

Authoritative References

The following authoritative sources define and govern supply chain risk management requirements:

Texas Administrative Code (TAC) – Chapter 202, Subchapter C

• §202.74 – Institution Information Security Program
  • Requires implementation of a comprehensive information security program, including third-party and system protections
• §202.75 – Managing Security Risks
  • Requires risk-based identification and mitigation of threats, including those associated with external dependencies
• §202.76 – Security Control Standards Catalog
  • Mandates implementation of DIR-defined supply chain and system acquisition controls
• §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
  • Establishes requirements for cloud and third-party service providers, including authorization, monitoring, and compliance

Texas Department of Information Resources (DIR)

• DIR Security Control Standards Catalog (mandated by TAC §202.76)

SR – Supply Chain Risk Management Control Family, including:

• SR-1 – Supply Chain Risk Management Policy and Procedures
• SR-2 – Supply Chain Risk Management Plan
• SR-3 – Supply Chain Controls and Processes
• SR-5 – Acquisition Strategies, Tools, and Methods
• SR-6 – Supplier Assessments and Reviews
• SR-10 – Inspection of Supplier-Provided Components

These controls define:

• Establishment of SCRM programs and governance
• Integration of supply chain risk into acquisition processes
• Vendor assessment, monitoring, and oversight requirements
• Lifecycle security for supplied components and services [clearedsystems.com]

University of Texas System (UTS) Policies

• UTS 165 – Information Resources Use and Security Policy (Parent Policy)
• UTS 165.1 – Information Security Organization, Personnel & Privacy Policy
  • Section 4.2 – Cybersecurity Risk Management Objectives, including:
  • Enterprise risk management integration
  • Risk identification and treatment across dependencies
• UTS 165.2 – Information Security Technology Policy
  • Section 4.3 – System Development & Maintenance Objectives (Supporting acquisition lifecycle security)
  • Section 4.1 – Access Management Objectives (Supporting third-party access governance)

University of Texas at Austin – Information Resources Use and Security Policy (IRUSP)

Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP Standards:

• Standard 22 – Vendor and Third-Party Controls and Compliance (Primary)
• Standard 10 – Risk Management (Supporting SCRM integration)
• Standard 4 – Access Management (Supporting third-party access control)

These standards collectively define:

• Vendor and third-party security governance
• Risk-based supply chain evaluation
• Controls for access and integration of external systems

Federal and Contractual Requirements

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting

Requires:

• Implementation of NIST SP 800-171 controls, including Supply Chain Risk Management
• Flow-down of safeguarding requirements to subcontractors handling Covered Defense Information (CDI)
• Protection of CUI across contractor-owned and external systems
• Monitoring and reporting of incidents involving supply chain components

Governance Scope Statement

This governance scope ensures that all applicable NIST SP 800-171 Rev. 3 control objectives for CUI systems are:

• Consistently implemented and managed across all security control families
• Aligned with Texas Administrative Code (TAC) Chapter 202 as the governing regulatory framework
• Operationalized through the DIR Security Control Standards Catalog, which provides the mandated control baseline
• Governed and enforced through UTS 165 policy framework and institutional IRUSP standards, ensuring both enterprise-level oversight and operational execution

This integrated model establishes a unified, risk-based, and auditable governance framework that:

• Enables traceability across NIST, TAC, DIR, UTS, and IRUSP requirements
• Supports continuous monitoring, control validation, and risk management
• Ensures consistent protection of Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP
• Provides a defensible foundation for CMMC Level 2, regulatory compliance, and contractual obligations (including DFARS)

Governance and Oversight

UT Austin establishes and maintains a formal governance framework to ensure that all CUI systems enrolled in CRSP effectively protect Controlled Unclassified Information (CUI) and comply with applicable institutional, state, federal, and contractual requirements.

6.1 Policy and Documentation Management UT Austin maintains a centralized and controlled governance process for all information security policies, procedures, standards, plans, and supporting documentation applicable to CUI systems.

All governance artifacts shall be:

• Formally documented, reviewed, approved, and disseminated through designated governance authorities
• Maintained in an authoritative repository with version control and defined ownership
• Reviewed on a defined schedule and upon significant changes, including:
  • Regulatory or contractual updates
  • System or architectural changes
  • Emerging risks or threat conditions

This ensures continued alignment with:

• NIST SP 800-171 Rev. 3
• Texas Administrative Code (TAC) Chapter 202
• DIR Security Control Standards Catalog
• University of Texas System (UTS 165) policies
• UT Austin Information Resources Use and Security Policy (IRUSP)

6.2 Risk Management Integration UT Austin integrates risk management processes into all governance activities to ensure that decisions are informed, prioritized, and aligned with institutional risk tolerance.

Risk management practices shall:

• Inform control selection, policy development, and governance updates
• Incorporate risk assessments, threat intelligence, vulnerability data, and impact analyses
• Address risks related to:
  • Systems and infrastructure
  • Supply chain and third-party dependencies
  • Operational and research environments

Risk evaluation results shall be documented and used to support risk-based decision-making and continuous governance alignment, consistent with UTS policy objectives and IRUSP risk management expectations.

6.3 Compliance Oversight UT Austin establishes oversight mechanisms to monitor, assess, and enforce compliance with applicable requirements, including:

• NIST SP 800-171 Rev. 3
• Texas Administrative Code (TAC) Chapter 202
• DIR Security Control Standards Catalog
• UT System (UTS 165) policies
• UT Austin IRUSP standards and institutional controls
• Federal and contractual requirements (e.g., DFARS 252.204-7012)

Governance procedures require that:

• Deviations or exceptions are:
  • Formally documented
  • Risk-assessed with defined impact
  • Approved by designated authorities prior to implementation
• Compliance status is continuously monitored, measured, and reported.

6.4 Accountability and Traceability UT Austin ensures governance accountability through comprehensive documentation and recordkeeping, including:

• Policy approvals and revisions
• Risk assessments and risk acceptance decisions
• Security assessments, audits, and POA&M tracking
• Incident response and reporting activities
• Governance reviews and decision records

Governance records shall be:

• Retained in accordance with institutional and IRUSP-aligned retention requirements
• Protected against unauthorized modification or loss
• Maintained to support auditability, traceability, and regulatory reporting

6.5 Interagency and System Coordination UT Austin governance processes require coordination across institutional, system-wide, and external entities, including:

• University of Texas System (UTS)
• Texas Department of Information Resources (DIR)
• UT Austin IRUSP governance and compliance functions
• State and federal oversight bodies
• Research sponsors and contractual partners

Governance activities shall:

• Support required reporting, submissions, and compliance obligations
• Align with system-wide directives and institutional standards
• Ensure coordination across policy, operational, and research domains

6.6 Continuous Improvement UT Austin employs a continuous improvement model to maintain an adaptive and effective governance posture.

Governance processes and documentation shall be updated based on:

• Audit findings and assessment results
• Continuous monitoring outputs
• Changes in TAC, DIR, UTS, or IRUSP requirements
• Emerging threats, vulnerabilities, and operational risks
• Lessons learned from incidents, testing, and exercises

This ensures governance remains current, risk-informed, and aligned with evolving regulatory and institutional expectations.

6.7 Governance Framework Statement

This policy establishes a formal, integrated governance framework that:

• Aligns:
  • TAC Chapter 202 (regulatory requirements)
  • DIR Security Control Standards Catalog (mandatory control baseline)
  • UTS 165 policies (system-wide governance and objectives)
  • UT Austin IRUSP standards (institutional implementation and enforcement)
• Provides a structured, repeatable approach to the development, review, approval, maintenance, and oversight of governance artifacts
• Enables end-to-end traceability across NIST, TAC, DIR, UTS, and IRUSP requirements
• Supports:
  • Risk-based decision-making
  • Continuous monitoring and control validation
  • Audit readiness and regulatory compliance

This framework ensures the consistent protection of Controlled Unclassified Information (CUI) and institutional information assets on CUI systems enrolled in CRSP, while maintaining readiness for CMMC Level 2 certification, regulatory review, and contractual compliance obligations.

Policy Compliance, Enforcement, and Exceptions

7.1 Compliance Requirements

All personnel, organizational units, systems, and third-party entities within the scope of this policy shall comply with all requirements defined herein and in supporting subordinate documentation.

Mandatory compliance applies to:

• All CUI systems
• All personnel and contractors supporting CUI systems
• All third-party service providers with access to or responsibility for CUI

All in-scope entities shall:

• Implement and maintain security controls in accordance with this policy
• Adhere to applicable:
  • Federal and contractual requirements (e.g., NIST SP 800-171 Rev. 3, DFARS)
  • Texas Administrative Code (TAC) Chapter 202
  • DIR Security Control Standards Catalog
  • UTS 165 policies
  • UT Austin IRUSP standards

Failure to comply with this policy constitutes a violation of institutional security requirements.

7.2 Enforcement

UT Austin shall implement enforcement mechanisms to ensure adherence to this policy and associated requirements.

7.2.1 MONITORING AND AUDITING

Compliance shall be enforced through:

• Continuous monitoring of system security posture
• Periodic internal reviews and control assessments
• Independent audits and external assessments (e.g., CMMC, DIR reviews)
• Automated and manual monitoring of control effectiveness

Audit and monitoring activities shall:

• Validate control implementation and effectiveness
• Identify deviations, deficiencies, or non-compliance
• Support regulatory and contractual reporting obligations

7.2.2 NON-COMPLIANCE AND CORRECTIVE ACTIONS

Instances of non-compliance shall be:

• Documented and recorded
• Evaluated based on risk and impact to CUI
• Tracked through formal remediation processes (e.g., POA&M)

Corrective actions may include:

• Immediate remediation of identified deficiencies
• Implementation of compensating controls
• Increased monitoring or oversight
• Temporary or permanent restriction of system access
• Escalation to governance authorities and leadership

Repeated or significant non-compliance may result in:

• Revocation of system authorization
• Disciplinary or contractual actions in accordance with institutional policies

7.3 Exception Management

UT Austin shall maintain a formal exception management process to allow for controlled and risk-informed deviations from policy requirements.

7.3.1 EXCEPTION REQUEST PROCESS

Exceptions shall be:

• Formally requested prior to implementation of the deviation
• Submitted through designated governance or risk management channels
• Reviewed by appropriate control owners and security authorities

Emergency exceptions (if applicable) shall be:

• Documented and reviewed retroactively within a defined timeframe

7.3.2 DOCUMENTATION AND JUSTIFICATION

All exception requests shall include, at a minimum:

• Description of the requirement being excepted
• Justification for the exception
• Scope and affected systems or components
• Duration of the exception
• Proposed compensating controls (if applicable)
• Assessment of risk to CUI and system operations

7.3.3 RISK ACCEPTANCE AND APPROVAL

All exceptions shall undergo formal risk evaluation and shall:

• Be reviewed and approved by designated authorities (e.g., system owner, information security, Authorizing Official as applicable)
• Include documented risk acceptance decisions
• Align with institutional risk tolerance and governance requirements

Exceptions shall not be implemented until formally approved, unless emergency provisions apply.

7.3.4 TRACKING AND PERIODIC REVIEW

Approved exceptions shall be:

• Tracked in a centralized repository
• Included in governance and compliance reporting
• Periodically reviewed to ensure:
  • Continued validity
  • Risk remains acceptable
  • Compensating controls remain effective

Exceptions shall be:

• Renewed, modified, or terminated based on review outcomes
• Closed when the underlying condition is resolved

7.4 Integration with Governance and Risk Management

Compliance, enforcement, and exception management processes shall be fully integrated with:

• Risk management and risk acceptance processes
• Security assessment and authorization activities
• Continuous monitoring and audit functions
• Incident response and corrective action workflows

Documentation generated through these processes shall support:

• Auditability and regulatory reporting
• CMMC Level 2 assessment requirements
• Ongoing governance and compliance validation

Appendix A – References

This appendix provides the authoritative sources that define, govern, and support the requirements established in this Governance Policy for the protection of Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP.

A.1 Regulatory Authorities

The following regulatory sources establish mandatory information security requirements applicable to UT Austin and CUI systems:

• Texas Administrative Code (TAC) Chapter 202 – Information Security Standards
  • §202.72 – Staff Responsibilities
  • §202.73 – Security Reporting
  • §202.74 – Institution Information Security Program
  • §202.75 – Managing Security Risks
  • §202.76 – Security Control Standards Catalog
  • §202.77 – Texas Risk and Authorization Management Program (TX-RAMP)
• Texas Department of Information Resources (DIR)
  • DIR Security Control Standards Catalog (mandated by TAC §202.76)
  • DIR guidance for risk management, security controls, and compliance reporting

A.2 Federal Standards and Frameworks

The following federal standards and security frameworks define baseline requirements and best practices for protecting CUI:

• NIST Special Publication 800-171 Revision 3
  • Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations
• NIST Special Publication 800-53 (Referenced via DIR Control Catalog)
  • Security and Privacy Controls for Information Systems and Organizations
• NIST Special Publication 800-37
  • Risk Management Framework (RMF) for Information Systems and Organizations
• NIST Special Publication 800-30
  • Guide for Conducting Risk Assessments
• NIST Special Publication 800-61
  • Computer Security Incident Handling Guide
• NIST Special Publication 800-63
  • Digital Identity Guidelines
• NIST Special Publication 800-88
  • Guidelines for Media Sanitization
• NIST Special Publication 800-137
  • Information Security Continuous Monitoring (ISCM)

A.3 CMMC Framework

The Cybersecurity Maturity Model Certification (CMMC) framework establishes assessment and certification requirements for organizations handling CUI:

• CMMC Model (Aligned to NIST SP 800-171 Rev. 3)
  • Defines maturity and assessment requirements for defense contractors and affiliated entities
• CMMC Level 2 Requirements
  • Based on full implementation of NIST SP 800-171 security controls
  • Requires documented, implemented, and assessed control practices

A.4 Institutional Policies and Standards

The following University of Texas System and UT Austin policies provide governance, implementation requirements, and operational standards:

University of Texas System (UTS)

• UTS 165 – Information Resources Use and Security Policy
• UTS 165.1 – Information Security Organization, Personnel, and Privacy Policy
• UTS 165.2 – Information Security Technology Policy
• UTS 165.3 – Information Security Physical and Environmental Protection Policy

These policies establish system-wide requirements for:

• Governance and oversight
• Risk management
• Access control
• Monitoring and compliance

UT Austin (IRUSP and Related Standards)

• Information Resources Use and Security Policy (IRUSP) https://security.utexas.edu/policies/irusp

Applicable IRUSP standards include, but are not limited to:

• Standard 1 – Information Resources Security Responsibilities and Accountability
• Standard 2 – Acceptable Use of Information Resources
• Standard 3 – Information Security Programs
• Standard 4 – Access Management
• Standard 5 – Administrative/Special Access Accounts
• Standard 7 – Change Management
• Standard 10 – Risk Management
• Standard 11 – Safeguarding Data
• Standard 12 – Security Incident Management
• Standard 15 – Passwords
• Standard 16 – Data Center Security
• Standard 17 – Security Monitoring
• Standard 18 – Security Training
• Standard 19 – Server and Device Configuration and Management
• Standard 22 – Vendor and Third-Party Controls and Compliance

A.5 Federal and Contractual Requirements

The following contractual and regulatory requirements apply to systems handling Controlled Unclassified Information (CUI):

• DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
  • Requires implementation of NIST SP 800-171 controls
  • Mandates incident reporting within 72 hours
  • Requires protection of Covered Defense Information (CDI)
  • Requires flow-down of requirements to subcontractors
• Federal Acquisition Regulation (FAR) Clauses (as applicable)
  • Security and privacy requirements for federal contracts
• Sponsor-Specific Security Requirements
  • Agency-specific requirements for research or contracted systems
  • Additional security or reporting obligations depending on sponsor

A.6 Supporting Guidance and Industry Standards

The following guidance documents support implementation and operationalization of controls:

• NIST guidance publications supporting implementation of 800-171 controls
• Industry-accepted security frameworks aligned with NIST standards
• Security best practices for:
  • Cloud computing and shared services
  • Secure system development
  • Vulnerability and patch management
  • Identity and access management

Appendix B – Control Traceability Matrix

This appendix establishes a formal control traceability model that maps security control requirements across governing authorities to ensure consistent implementation, validation, and auditability of controls protecting Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP.

This matrix provides traceability between:

• NIST SP 800-171 Rev. 3 control families (federal baseline)
• Texas Administrative Code (TAC) Chapter 202 (regulatory requirements)
• DIR Security Control Standards Catalog (control baseline implementation)
• UT System (UTS 165) policies (system-wide governance)
• UT Austin IRUSP standards (institutional implementation and enforcement)

B.1 Traceability Model Overview

All controls implemented within CUI systems shall:

• Map to one or more NIST SP 800-171 controls
• Align with TAC 202 regulatory requirements
• Implement corresponding DIR control families
• Conform to UTS policy requirements
• Be operationalized through IRUSP standards and procedures

This model ensures:

• End-to-end traceability across governance layers
• Consistent control implementation
• Audit defensibility and evidence alignment

B.2 Control Family Traceability Matrix

B.3 Traceability Requirements

CUI systems shall ensure:

• Each implemented control is:
  • Mapped to a NIST 800-171 control
  • Aligned to DIR control requirements
  • Traceable to TAC regulatory obligations
  • Implemented through IRUSP standards or equivalent controls
• Traceability shall be maintained through:
  • System Security Plans (SSPs)
  • Control implementation documentation
  • Assessment artifacts
  • POA&M tracking

B.4 Use of the Traceability Matrix

This matrix shall be used to:

Audit Traceability

• Demonstrate linkage between implemented controls and governing requirements
• Support internal and external audits

CMMC Validation

• Provide evidence of alignment with:
  • NIST SP 800-171 Rev. 3
  • CMMC Level 2 practices

DIR Compliance Validation

• Demonstrate implementation of DIR-mandated controls
• Validate alignment with TAC Chapter 202

Governance and Control Alignment

• Ensure consistent interpretation and implementation across:
  • Systems
  • Organizational units
  • Control owners

B.5 Maintenance and Updates

This traceability matrix shall be:

• Reviewed periodically in alignment with:
  • Policy updates
  • Regulatory changes
  • DIR catalog updates
  • NIST revisions
• Updated as necessary to ensure:
  • Continued alignment with authoritative sources
  • Accuracy of control mappings
  • Support for audit and assessment activities

CRSP Standard 3.1: Access Control (AC)

NIST SP 800-171 Rev. 3, Family 3.1

Purpose of Policy

The University of Texas at Austin (UT Austin) establishes this policy to provide a structured and risk-based approach for implementing access control measures that support the security requirements defined in NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.”

This policy applies to all CUI systems, applications, and system components enrolled in CRSP that store, process, or transmit Controlled Unclassified Information (CUI).

The policy defines requirements for:

• Managing access to systems containing CUI in accordance with the principles of least privilege, separation of duties, and need-to-know.
• Granting access only to authorized users based on their roles and responsibilities on CUI systems enrolled in CRSP.
• Ensuring access restrictions effectively prevent unauthorized use while enabling legitimate users to perform their assigned duties.

This policy provides the foundation for establishing, reviewing, and enforcing access control mechanisms, including user account management, privilege assignment, and authorization procedures, to ensure compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy.

Scope of Policy

This Access Control Policy applies exclusively to users, systems, networks, devices, services, and processes operating as part of or directly interacting with CUI systems enrolled in CRSP that process, store, or transmit Controlled Unclassified Information (CUI). This includes on-premises infrastructure, cloud-hosted services, and third-party platforms specifically authorized for CUI processing on CUI systems enrolled in CRSP.

This policy applies to all UT Austin personnel, contractors, sponsored researchers, foreign nationals (as authorized), and approved service providers who have authorized access to CUI systems. It also applies to any organizationally owned or personally owned device that is explicitly authorized to connect to or interact with CUI environments, subject to established authorization to access CUI systems, security configuration, and monitoring requirements.

Explicit Exclusions This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated as part of a CUI system enrolled in CRSP.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CUI.
• Personally owned devices that do not connect to or access CUI environments.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

This policy establishes the baseline requirements for implementing and enforcing access controls within the applicable CUI system boundary in accordance with NIST SP 800-171 and UT Austin CRSP Standard 3.0: CUI Governance. These requirements include, but are not limited to:

Control Requirements

The implementation of these controls is critical to protecting the confidentiality of CUI in accordance with federal requirements. This policy supports consistent enforcement of access restrictions, reduces the risk of unauthorized disclosure, and promotes compliance across all systems within the applicable CUI system boundary.

Departments and Responsibilities

Departments and responsibilities related to access control on CUI systems enrolled in CRSP are defined to ensure clear accountability and effective implementation of this policy. The table below outlines key roles and their associated responsibilities in accordance with applicable security requirements.

UT Austin CISO, in coordination with designated Information System Owners, is responsible for ensuring that all assigned departments and responsibilities remain accurate, current, and appropriate for the individuals or teams supporting CUI-related systems. Role assignments must reflect the principles of least privilege, separation of duties, and organizational risk management objectives.

Departments and Responsibilities

Senior Management Commitment

Senior management at the University of Texas at Austin (UT Austin) affirms its commitment to the effective implementation, oversight, and enforcement of this Access Control Policy on CUI systems enrolled in CRSP.

Senior management supports this policy by ensuring that appropriate administrative, technical, and operational controls are established and maintained to regulate access to systems, applications, and components that process, store, or transmit Controlled Unclassified Information (CUI).

UT Austin senior leadership further ensures that sufficient resources—including qualified personnel, enabling technologies, and funding—are allocated to support the implementation, monitoring, enforcement, and continuous improvement of access control practices.

This commitment underscores the University’s recognition of the critical role that effective access control plays in:

• Safeguarding the confidentiality, integrity, and availability of CUI on CUI systems enrolled in CRSP;
• Maintaining cybersecurity resilience across research and CUI systems;
• Ensuring compliance with federal, state, and institutional requirements that support UT Austin research operations and mission objectives.

Policy Statement

The access and use of Information Technology (IT) resources on CUI systems enrolled in CRSP shall be governed in accordance with applicable Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) Special Publications, and the UT Austin CRSP 3.0 CUI Governance Policy.

UT Austin develops, documents, and disseminates an Access Control Policy applicable to CUI systems enrolled in CRSP that:

• Defines the University’s strategic approach to access control, including clearly assigned roles, responsibilities, and enforcement mechanisms.
• Establishes organizational requirements for user identification, authentication, authorization, and accountability to ensure secure and auditable system access.
• Requires periodic review of user access privileges and the timely revocation of access following role changes, personnel separations, or other access-impacting events.

Supporting operational procedures are maintained to implement this policy and include:

• Defined processes for onboarding and offboarding users to ensure appropriate access provisioning and timely deprovisioning.
• Structured methods for managing access to information systems and sensitive resources based on the principles of least privilege and need-to-know.
• Technical configurations and administrative controls that support Role-Based Access Control (RBAC), including the generation, monitoring, and review of access event logs.

UT Austin designates the Chief Information Security Officer (CISO) as accountable for the development, oversight, and periodic review of this policy and its associated procedures. The Information System Owner (ISO) is responsible for ensuring the dissemination, implementation, and operational enforcement of these requirements within systems under their authority.

This policy shall be reviewed and updated at least once every three (3) years, or more frequently as necessary to reflect significant changes in technology, operational environments, threat conditions, or applicable regulatory requirements. Supporting procedures shall be reviewed at least annually to ensure continued alignment with current operational practices, evolving threat landscapes, and applicable compliance obligations.

Control Requirements

03.01.01 Account Management

Control Requirement:

1. Define the types of system accounts allowed and prohibited.
2. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria.
3. Specify:
4. Authorized users of the system,
5. Group and role membership, and
6. Access authorizations (i.e., privileges) for each account.
7. Authorize access to the system based on:
8. A valid access authorization and
9. Intended system usage.
10. Monitor the use of system accounts.
11. Disable system accounts when:
12. The accounts have expired,
13. The accounts have been inactive for at most 90 days,
14. The accounts are no longer associated with a user or individual,
15. The accounts are in violation of organizational policy, or
16. Significant risks associated with individuals are discovered.

• Notify account managers and designated personnel or roles within:

1. 24 hours when accounts are no longer required.
2. 24 hours when users are terminated or transferred.
3. 24 hours when system usage or the need-to-know changes for an individual.
4. Require that users log out of the system after at most 24 hours of expected inactivity or when the work period ends, for privileged users at a minimum.

Policy Statement:

The University of Texas at Austin (UT Austin) shall establish, document, and enforce account management requirements for all CUI systems enrolled in CRSP.

UT Austin enforces account management controls that:

• Define and approve the types of system accounts that are permitted and explicitly prohibit unauthorized or unmanaged accounts;
• Require that all system accounts are created, enabled, modified, disabled, and removed only in accordance with formally approved policies, procedures, prerequisites, and authorization criteria;
• Ensure each system account is associated with an authorized individual, group, role, service, or device, and that group membership, role assignments, and access privileges are explicitly defined and aligned with assigned duties and intended system usage;
• Authorize logical access to systems and CUI only after verification of a valid access authorization and documented need-to-know;
• Monitor the use of system accounts to detect unauthorized, inappropriate, or anomalous activity;
• Require the disabling of system accounts that are expired, inactive for no more than ninety (90) days, no longer associated with an authorized individual, in violation of organizational policy, or determined to present significant organizational risk;
• Mandate notification to designated account managers and responsible roles within twenty-four

1. hours when accounts are no longer required, when users are terminated or transferred, or

when an individual’s system usage or need-to-know changes;

• Require users to log out of systems after no more than twenty-four (24) hours of expected inactivity, or when defined organizational circumstances occur, including at the end of the work period for privileged users, at a minimum, to reduce the risk of unauthorized access.

Account management requirements shall support the principles of least privilege, separation of duties, and accountability, and shall be consistently enforced across all CUI systems enrolled in CRSP in accordance with the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.01.02 Access Enforcement

Control Requirement:

Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.

Policy Statement:

UT Austin shall enforce approved authorizations for logical access to CUI and system resources on CUI systems enrolled in CRSP.

UT Austin enforces access control mechanisms on CUI systems enrolled in CRSP that:

• Ensure logical access to information systems, applications, and CUI is permitted only for authorized users, roles, services, and processes with documented access approvals;
• Restrict access to system resources and CUI in accordance with established access control policies, least privilege principles, and approved role-based access authorizations;
• Prevent unauthorized access, privilege escalation, and circumvention of access control mechanisms;
• Apply access enforcement consistently across all system components, including operating systems, applications, databases, and networked services.

Access enforcement controls shall be implemented to support accountability, protect the confidentiality of CUI, and ensure compliance with the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.01.03 Information Flow Enforcement

Control Requirement:

Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.

Policy Statement:

UT Austin shall enforce approved authorizations to control the flow of CUI within CUI systems and between interconnected systems.

UT Austin enforces information flow controls on CUI systems enrolled in CRSP that:

• Ensure CUI is transmitted, accessed, and exchanged only through authorized system interfaces, services, and communication pathways;
• Restrict the movement of CUI based on defined access authorizations, system interconnection agreements, and documented data handling requirements;
• Prevent unauthorized transfer, dissemination, or exposure of CUI within systems or across system boundaries;
• Support the secure integration of interconnected systems while maintaining compliance with applicable CUI handling and protection requirements.

Information flow enforcement supports the confidentiality and controlled dissemination of CUI on CUI systems enrolled in CRSP and is implemented in accordance with the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.01.04 Separation of Duties

Control Requirement:

1. Identify the duties of individuals requiring separation.
2. Define system access authorizations to support separation of duties.

Policy Statement:

UT Austin shall identify duties and functions requiring separation and define system access authorizations that enforce separation of duties for CUI systems enrolled in CRSP.

UT Austin enforces separation of duties by:

• Assigning distinct roles and responsibilities to individuals or teams to reduce the risk of unauthorized, unintentional, or malicious activity;
• Ensuring that critical system functions—such as access approval, system administration, security oversight, and audit review—are not performed by the same individual;
• Defining role-based access authorizations that prevent any single individual from exercising excessive control over CUI systems or data.

Where full separation of duties cannot be achieved due to operational or technical constraints, UT Austin shall implement and document compensating controls, such as management oversight, peer review, or enhanced auditing.

Separation of duties assignments and associated access authorizations are reviewed periodically by designated system and security officials to ensure continued alignment with organizational structure, risk management objectives, and UT Austin CRSP 3.0 CUI Governance Policy requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.01.05 Least Privilege

Control Requirement:

1. Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.
2. Authorize access to at a minimum and if applicable: establishing system accounts and assigning privileges, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information and at a minimum and if applicable: threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, security architecture, access control lists, and audit information.
3. Review the privileges assigned to roles or classes of users at least every 12 months to validate the need for such privileges.
4. Reassign or remove privileges, as necessary.

Policy Statement:

UT Austin shall enforce the principle of least privilege by authorizing only the minimum system access necessary for users, roles, and system processes to perform assigned organizational tasks involving CUI on CUI systems enrolled in CRSP.

UT Austin restricts access to system functions, security functions, and security-relevant information based on documented role assignments, approved need-to-know, and intended system usage. Access to security functions shall be limited to authorized roles and, at a minimum and where applicable, includes the ability to:

• Establish system accounts and assign privileges;
• Configure access authorizations;
• Configure settings for events to be audited;
• Establish vulnerability scanning parameters;
• Establish intrusion detection parameters; and
• Manage audit information.

Access to security-relevant information shall also be restricted to authorized roles and, at a minimum and where applicable, includes:

• Threat and vulnerability information;
• Router or firewall filtering rules;
• Configuration parameters for security services;
• Cryptographic key management information;
• Security architecture documentation;
• Access control lists; and
• Audit information.

Privileges assigned to roles or classes of users shall be reviewed at least every twelve (12) months to validate continued operational necessity and risk appropriateness. Access rights that are no longer required, exceed job responsibilities, or present unnecessary risk shall be promptly reassigned, reduced, or removed.

Least privilege enforcement supports risk reduction, accountability, and compliance with the UT Austin CRSP 3.0 CUI Governance Policy, and is maintained through governance, role definition, and ongoing oversight.

Responsible Departments, Tasks, and Frequencies Table:

03.01.06 Least Privilege – Privileged Accounts

Control Requirement:

1. Restrict privileged accounts on the system to only defined and authorized personnel or administrative roles.
2. Require that users (or roles) with privileged accounts use non-privileged accounts when accessing non-security functions or non-security information.

Policy Statement:

UT Austin shall restrict the use of privileged accounts on CUI systems enrolled in CRSP to only defined and authorized personnel or roles with an approved operational need.

UT Austin requires that privileged accounts be used solely for the performance of authorized security or system administration functions. Individuals assigned privileged access shall use non-privileged accounts when performing non-security functions or accessing non-security information to reduce the risk of misuse, error, or unauthorized activity.

The assignment, use, and oversight of privileged accounts shall align with the principles of least privilege and separation of duties and shall be subject to management oversight, monitoring, and periodic review to ensure continued appropriateness and compliance with applicable access control policies.

This policy supports compliance with the UT Austin CRSP 3.0 CUI Governance Policy by minimizing exposure of elevated privileges and reducing the potential impact of compromise on CUI systems enrolled in CRSP.

Responsible Departments, Tasks, and Frequencies Table:

03.01.07 Least Privilege – Privileged Functions

Control Requirement:

1. Prevent non-privileged users from executing privileged functions.
2. Log the execution of privileged functions.

Policy Statement:

UT Austin shall ensure that privileged functions on CUI systems enrolled in CRSP are restricted to authorized privileged users and roles only.

UT Austin shall prevent non-privileged users from executing privileged system functions, including administrative, security, and configuration-related actions, through the enforcement of logical access controls and role-based authorization mechanisms.

UT Austin shall require that the execution of privileged functions is logged and auditable to support accountability, monitoring, and the detection of unauthorized or inappropriate activity. Logs associated with privileged function execution shall be protected from unauthorized access and reviewed in accordance with applicable audit and monitoring policies.

This policy enforces the principles of least privilege and accountability and supports compliance with the UT Austin CRSP 3.0 CUI Governance Policy by reducing the risk associated with elevated system privileges on CUI systems enrolled in CRSP.

Responsible Departments, Tasks, and Frequencies Table:

03.01.08 Unsuccessful Logon Attempts

Control Requirement:

1. Enforce a limit of at most five (5) consecutive invalid logon attempts by a user during a period of five
2. minutes.
3. Automatically [Selection (one or more): lock the account or node for at least 15-minute time period; lock the account or node until released by an administrator and notify a system administrator] when the maximum number of unsuccessful attempts is exceeded.

Policy Statement:

UT Austin shall enforce controls to limit the number of consecutive unsuccessful logon attempts for user accounts accessing CUI systems enrolled in CRSP.

UT Austin shall restrict user accounts to a maximum of five (5) consecutive invalid logon attempts within a five (5) minute period. When this threshold is exceeded, the system shall automatically:

• Lock the account or node for at least 15 minutes, or
• Lock the account or node until released by an administrator, and
• Notify the system administrator of the event.

These measures ensure that access attempts are monitored, unauthorized access attempts are mitigated, and system security is maintained. All account lockouts shall be logged and reviewed to support audit, accountability, and incident response processes in accordance with the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.01.09 System Use Notification

Control Requirement:

Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.

Policy Statement:

UT Austin shall display a system use notification message to all users prior to granting access to CUI systems enrolled in CRSP. The notification shall include:

• Privacy notices informing users of the confidentiality of CUI and the monitoring of system activity.
• Security notices specifying authorized use, restrictions, and user responsibilities.
• Acknowledgment of compliance requirements, including adherence to the UT Austin CRSP 3.0 CUI Governance Policy.

Users must acknowledge the notification before being granted access to the system. The system shall prevent access to any user who does not provide the required acknowledgment. System use notifications shall be regularly reviewed and updated to ensure continued compliance with applicable regulations, institutional policies, and evolving cybersecurity requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.01.10 Device Lock

Control Requirement:

1. Prevent access to the system by initiating a device lock after, at most, 15 minutes of inactivity and requiring the user to initiate a device lock before leaving the system unattended.
2. Retain the device lock until the user reestablishes access using established identification and authentication procedures.
3. Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Policy Statement:

UT Austin shall prevent unauthorized access to CUI systems enrolled in CRSP by implementing device lock mechanisms.

• Systems shall automatically initiate a device lock after at most 15 minutes of user inactivity.
• Users are required to manually engage a device lock before leaving the system unattended.
• Locked devices shall retain access control until the user successfully reestablishes access using approved identification and authentication procedures.
• Any information previously visible on the display shall be concealed or obscured during the device lock, preventing exposure to unauthorized viewers.

Device lock policies shall be applied to all user devices, including desktops, laptops, mobile devices, and workstations that handle CUI on CUI systems enrolled in CRSP. Implementation and compliance shall be periodically reviewed to ensure effectiveness and alignment with institutional security requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.01.11 Session Termination

Control Requirement:

Terminate a user session automatically after a specified duration (maximum of 24 hours) of inactivity, misbehavior (end the session due to an attempted policy violation), and maintenance (terminate sessions to prevent issues with an upgrade or service outage).

Policy Statement:

UT Austin shall protect CUI systems enrolled in CRSP and the CUI they handle by automatically terminating user sessions under specific conditions to reduce the risk of unauthorized access or policy violations.

• User sessions shall be automatically terminated after a maximum of 24 hours of inactivity.
• Sessions shall be terminated immediately in response to misbehavior, including attempts to violate established access control or security policies.
• Sessions may be terminated to support system maintenance, including software upgrades, patching, or service outages, to prevent conflicts or unauthorized access during these events.

Automatic session termination mechanisms shall be applied to all CUI systems enrolled in CRSP. Termination events shall be logged, monitored, and reviewed to ensure compliance and to detect potential security incidents.

Responsible Departments, Tasks, and Frequencies Table:

03.01.12 Remote Access

Control Requirement:

1. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.
2. Authorize each type of remote system access prior to establishing such connections.
3. Route remote access to the system through authorized and managed access control points.
4. Authorize the remote execution of privileged commands and remote access to security-relevant information.

Policy Statement:

UT Austin shall control and secure all remote access to CUI systems enrolled in CRSP to ensure confidentiality, integrity, and availability.

• Usage restrictions and configuration requirements shall be established for each type of remote access, including remote desktops, VPN connections, and cloud-based access, to enforce organizational security policies.
• Authorization for each type of remote system access must be obtained prior to establishing connections, and access shall be granted only to defined and approved personnel in alignment with their roles and responsibilities.
• All remote connections shall be routed through authorized and managed access control points, such as secure VPN gateways or multi-factor authenticated portals, to ensure accountability and monitoring of traffic.
• Remote execution of privileged commands or access to security-relevant information shall require explicit approval and must be restricted to authorized roles only, with all actions logged and auditable.

Remote access shall be continuously monitored, logged, and reviewed to ensure compliance with access policies, detect unauthorized activity, and support incident response. Security configurations and access authorizations shall be updated in response to changes in personnel, risk assessments, or system architecture.

Responsible Departments, Tasks, and Frequencies Table:

03.01.13 Withdrawn

Control Requirement: Incorporated into 03.01.12.

03.01.14 Withdrawn

Control Requirement: Incorporated into 03.01.12.

03.01.15 Withdrawn

Control Requirement: Incorporated into 03.01.12.

03.01.16 Wireless Access Authorization

Control Requirement:

1. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.
2. Authorize each type of wireless access to the system prior to establishing such connections.
3. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment.
4. Protect wireless access to the system using authentication and encryption.

Policy Statement:

UT Austin shall control and secure all wireless access to CUI systems enrolled in CRSP to ensure the confidentiality, integrity, and availability of sensitive information.

• Usage restrictions, configuration requirements, and connection requirements shall be established for all types of wireless access, including Wi-Fi, mobile hotspots, and any wireless-enabled devices, to enforce compliance with organizational security policies.
• Authorization for wireless access must be obtained prior to establishing any connection, and access shall be restricted to defined and approved personnel in accordance with their roles and operational need.
• Wireless networking capabilities that are not required for operational purposes shall be disabled prior to issuance and deployment of devices.
• All wireless access must be protected using strong authentication mechanisms and encryption protocols to prevent unauthorized access and eavesdropping.

Monitoring, logging, and periodic review of wireless connections shall be conducted to ensure compliance with security policies, detect unauthorized access, and support incident response. Wireless security configurations and authorizations shall be updated as needed to reflect changes in personnel, system architecture, or emerging risks.

Responsible Departments, Tasks, and Frequencies Table:

03.01.17 Withdrawn

Control Requirement: Incorporated into 03.01.16.

03.01.18 Access Control for Mobile Devices

Control Requirement:

1. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices.
2. Authorize the connection of mobile devices to the system.
3. Implement full-device or container-based encryption to protect the confidentiality of CUI on mobile devices.

Policy Statement:

UT Austin shall control and secure the use of mobile devices that access, process, store, or transmit CUI on CUI systems enrolled in CRSP to ensure the confidentiality, integrity, and availability of sensitive information.

• Usage restrictions, configuration requirements, and connection requirements shall be established for all mobile devices, including laptops, tablets, and smartphones, that connect to organizational systems.
• Authorization to connect mobile devices to CUI systems must be granted prior to access, limited to defined and approved personnel in accordance with their assigned roles and operational needs.
• Full-device encryption or container-based encryption shall be implemented on all mobile devices used to access, store, or transmit CUI to prevent unauthorized disclosure in case of loss or theft.

Monitoring and auditing of mobile device access shall be conducted regularly to detect unauthorized usage, ensure compliance with security policies, and support timely incident response. Mobile device configurations and authorizations shall be reviewed and updated as required by personnel changes, device lifecycle events, or emerging risks.

Responsible Departments, Tasks, and Frequencies Table:

03.01.19 Withdrawn

Control Requirement: Incorporated into 03.01.18.

03.01.20 Use of External Systems

Control Requirement:

1. Prohibit the use of external systems unless the systems are specifically authorized.
2. Establish the following security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized individuals: Guidance: Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems. If applicable, use NIST SP 800-47 as a guide for establishing information exchanges between organizations.
3. Permit authorized individuals to use external systems to access the organizational system or to process, store, or transmit CUI only after:
4. Verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied and
5. Retaining approved system connection or processing agreements with the organizational entities hosting the external systems.
6. Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems.

Policy Statement:

UT Austin shall restrict and control the use of external systems to protect CUI on CUI systems enrolled in CRSP and ensure compliance with organizational security requirements.

• Prohibited use: Access to organizational systems or processing, storing, or transmitting CUI on external systems as part of CRSP is prohibited unless the systems are specifically authorized.
• Security requirements: External systems must satisfy defined security requirements prior to use, including, at a minimum:
  • Approval of the types of applications and services that can access organizational systems from external systems;
  • Confirmation that the external system can adequately protect the highest security category of CUI intended for processing, storage, or transmission;
  • Compliance with guidance from NIST SP 800-47 when establishing information exchanges between organizational and external systems.
• Authorization and agreements: Authorized individuals may use external systems only after:

1. Verification that the security requirements for the external systems, as specified in the organizational system security plans, have been satisfied; and
2. Retention of approved system connection or processing agreements with the external system owners.

• Portable storage restrictions: Use of organization-controlled portable storage devices on external systems is restricted and permitted only in accordance with organizational policy and authorization.

Monitoring, auditing, and periodic review of authorized external system connections shall be conducted to ensure ongoing compliance with UT Austin security requirements. Unauthorized or non-compliant external system usage shall be reported and addressed according to institutional access control and incident response procedures.

Responsible Departments, Tasks, and Frequencies Table:

03.01.21 Withdrawn

Control Requirement: Incorporated into 03.01.20.

03.01.22 Publicly Accessible Content

Control Requirement:

1. Train authorized individuals to ensure that publicly accessible information does not contain CUI.
2. Review the content on publicly accessible systems for CUI and remove such information, if discovered.

Policy Statement:

UT Austin shall ensure that CUI on CUI systems enrolled in CRSP are not inadvertently exposed on publicly accessible systems.

• Training: All authorized individuals with access to CUI shall receive training to recognize and prevent the disclosure of CUI on public websites, cloud services, or other publicly accessible platforms.
• Content review: Authorized personnel shall regularly review publicly accessible content to verify that no CUI is present. Any CUI identified on such systems must be promptly removed or secured in accordance with UT Austin CUI handling policies.
• Accountability: Individuals responsible for content creation, publishing, or maintenance of publicly accessible systems shall follow institutional procedures and reporting requirements to prevent unauthorized disclosure of CUI.

Periodic audits and compliance reviews shall be conducted to ensure adherence to training requirements, content monitoring, and removal procedures, supporting UT Austin’s overall commitment to safeguarding CUI on CUI systems enrolled in CRSP in accordance with the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

NIST SP 800-171 Revision 2 to Revision 3 Change Analysis

CRSP Standard 3.2: Awareness and Training (AT)

NIST SP 800-171 Rev. 3, Family 3.2

Purpose of Policy

The University of Texas at Austin (UT Austin) establishes this policy to provide a structured and consistent approach for implementing security awareness and training measures that support the protection of Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP.

This policy supports the security requirements defined in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and aligns with the governance requirements established in the UT Austin CRSP 3.0 CUI Governance Policy.

This policy applies to all personnel—including employees, contractors, researchers, and other authorized users—who access, manage, administer, or support CUI systems enrolled in CRSP.

This policy establishes requirements for:

• Security Awareness Training: Ensuring all users receive appropriate security awareness training upon onboarding and periodically thereafter to understand security risks, acceptable system use, and their responsibilities for protecting CUI.
• Role-Based Security Training: Providing specialized training for individuals with privileged access, system administration responsibilities, security management duties, or other roles that require enhanced understanding of cybersecurity practices and CUI protection requirements.
• Security Culture and Accountability: Promoting a culture of cybersecurity awareness by ensuring personnel understand their responsibilities for safeguarding CUI, recognizing potential threats (e.g., phishing, social engineering, insider threats), and promptly reporting suspicious or malicious activity.

This policy provides the foundation for the development, delivery, and continuous improvement of the UT Austin CUI security awareness and training program, ensuring personnel supporting CUI systems are adequately prepared to protect the confidentiality, integrity, and availability of CUI while maintaining compliance with NIST SP 800-171 and applicable federal and institutional requirements.

Scope of Policy

This Awareness and Training Policy applies to all University of Texas at Austin (UT Austin) personnel, including faculty, staff, researchers, student workers, contractors, and service providers who access, manage, support, or use CUI systems enrolled in CRSP.

The scope of this policy includes:

• All UT Austin-managed and authorized third-party CUI systems enrolled in CRSP, including both on-premises and cloud-based systems that process, store, or transmit CUI.
• Any individual with authorized access to CUI systems, data, or environments where CUI is processed, stored, or transmitted.
• All awareness and training activities required to support the protection of CUI, including general security awareness training, specialized role-based security training, and periodic refresher training necessary to maintain compliance with CUI safeguarding requirements.

These requirements ensure that personnel supporting CUI systems enrolled in CRSP understand their security responsibilities, operational procedures, and compliance obligations associated with protecting CUI.

Explicit Exclusions

This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated and authorized as part of the applicable CUI system boundary.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CUI.
• Personally owned devices that do not connect to or access CUI systems or environments handling CUI.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

This policy establishes the requirements for developing, delivering, tracking, and maintaining security awareness and training programs that support UT Austin information security objectives and ensure compliance with NIST Special Publication 800-171 and institutional requirements defined in the UT Austin CRSP 3.0 CUI Governance Policy.

The scope of this policy includes, but is not limited to, the following awareness and training requirements applicable to the protection of CUI on CUI systems enrolled in CRSP.

Control Requirements

Departments and Responsibilities

Departments and responsibilities related to security awareness and training on CUI systems enrolled in CRSP are defined to ensure accountability, promote a culture of security, and support the effective implementation of training requirements for protecting Controlled Unclassified Information (CUI).

These responsibilities support compliance with NIST SP 800-171 awareness and training requirements and the UT Austin CRSP 3.0 CUI Governance Policy. Personnel assigned to these roles ensure that individuals who access or support CUI systems or CUI data receive appropriate security awareness and role-based training.

The table below outlines key roles and their associated responsibilities.

Departments and Responsibilities

Senior Management Commitment

This policy has been reviewed and formally approved by senior management. The University of Texas at Austin (UT Austin) executive leadership affirms its commitment to the effective implementation of the Awareness and Training (AT) principles and requirements established to protect Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP.

Senior management demonstrates support for this policy by:

• Ensuring security awareness and training programs are established, maintained, and enforced for all personnel who access or support CUI systems or CUI data.
• Providing sufficient resources, including qualified personnel, training platforms, awareness materials, and funding, necessary to develop, deliver, and maintain effective security awareness and role-based training programs.
• Promoting a culture of security awareness and accountability across research units, administrative offices, and technical teams responsible for protecting CUI.
• Ensuring that training requirements are incorporated into personnel onboarding, system access authorization processes, and ongoing operational activities for individuals supporting CUI systems.
• Supporting continuous improvement of awareness and training programs through periodic reviews, updates based on evolving threats, regulatory requirements, system changes, and lessons learned from incidents or audits.

This commitment reflects UT Austin leadership’s recognition of the critical role that security awareness and training play in protecting the confidentiality, integrity, and availability of CUI, strengthening the security posture of CUI systems, and ensuring compliance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Policy Statement

The implementation of security awareness and training initiatives for safeguarding information systems at the University of Texas at Austin (UT Austin) is governed by applicable Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) Special Publications, and UT Austin policies and standards governing Controlled Unclassified Information (CUI), including the UT Austin CRSP 3.0 CUI Governance Policy.

UT Austin develops, documents, and disseminates an Awareness and Training Policy that:

• Defines the University’s strategic approach to promoting security awareness and user accountability in support of protecting CUI on CUI systems enrolled in CRSP.
• Addresses the policy’s purpose, scope, assigned roles and responsibilities, senior management commitment, interdepartmental coordination, and compliance expectations necessary to support effective security awareness and training practices.
• Aligns with applicable federal laws, executive orders, directives, regulations, and institutional policies and standards, including the requirements defined in NIST SP 800-171.
• Establishes mandatory security awareness and role-based training requirements for all personnel with access to CUI systems or CUI, including individuals with privileged, administrative, or specialized system access.
• Requires periodic delivery of both general awareness training and role-specific security training to ensure continued understanding of security responsibilities, emerging cybersecurity threats, and proper handling of CUI.

Supporting Awareness and Training Procedures are developed and maintained to implement this policy and include:

• Defined onboarding processes requiring completion of required awareness and role-based training prior to granting access to CUI systems or CUI.
• Role-based and refresher training schedules determined by job responsibilities, system access levels, and operational risk exposure.
• Mechanisms for tracking training completion, monitoring user compliance, and addressing noncompliance in coordination with supervisors, system owners, and institutional compliance offices.

UT Austin designates the Chief Information Security Officer (CISO) as accountable for the development, governance, and periodic review of the Awareness and Training Policy, and the Information System Owner (ISO) as responsible for its dissemination and operational implementation within CUI systems enrolled in CRSP.

The Awareness and Training Policy is reviewed and updated at least once every three (3) years, or sooner in response to:

• Changes in applicable laws, regulations, or federal cybersecurity guidance;
• Security incidents or audit findings affecting CUI systems;
• Significant changes to system architecture, technologies, or organizational structure;
• Updates to institutional policies governing the protection of CUI.

Supporting Awareness and Training Procedures are reviewed annually and updated as necessary to ensure continued alignment with federal mandates, institutional governance requirements, and evolving cybersecurity threats affecting CUI systems and CUI protection.

Control Requirements

03.02.01 Literacy Training and Awareness

Control Requirement:

1. Provide security literacy training to system users:
2. As part of initial training for new users and at least every 12 months thereafter,
3. When required by system changes or following significant, novel incidents, or significant changes to risks and
4. On recognizing and reporting indicators of insider threat, social engineering, and social mining.
5. Update security literacy training content at least every 12 months and following significant, novel incidents, or significant changes to risks.

Policy Statement:

UT Austin ensures that all personnel—including faculty, staff, researchers, contractors, and affiliates—receive comprehensive security literacy and awareness training designed to promote the responsible handling and protection of CUI on CUI systems enrolled in CRSP.

UT Austin enforces the completion of the Center for Development of Security Excellence (CDSE) Cyber Awareness Challenge Course prior to initial access to CUI systems and annually thereafter. This training, combined with specialized modules such as Insider Threat Awareness (INT101.16), ensures that personnel understand their responsibilities in identifying, reporting, and mitigating cybersecurity risks, including insider threats, phishing attempts, social engineering, and social mining.

The Information System Security Officer (ISSO) maintains a Training and Certification Tracker on secured CUI systems to document and verify completion of all required courses for authorized personnel.

UT Austin’s literacy and awareness program incorporates:

• Role-based content tailored for system users, administrators, and management;
• Instruction on recognizing and reporting insider threats, social engineering tactics, and social mining activities;
• Training on appropriate handling, safeguarding, and transmission of CUI, consistent with NIST SP 800-171 requirements;
• Regular updates to training content based on audit findings, security incidents, regulatory or policy changes, and evolving threat landscapes.

Security awareness is reinforced through institutional communications, including periodic email bulletins, system login banners, awareness campaigns, and simulated phishing exercises to ensure continuous engagement and understanding of cybersecurity responsibilities across CUI systems enrolled in CRSP.

Responsible Departments, Tasks, and Frequencies Table:

03.02.02 Role-Based Security Training

Control Requirement:

1. Provide role-based security training to organizational personnel:
2. Before authorizing access to the system or CUI, before performing assigned duties, and at least every 12 months thereafter
3. When required by system changes or following significant, novel incidents, or significant changes to risks. b. Update role-based training content at least every 12 months and following significant, novel incidents, or significant changes to risks.
4. Ensure personnel are adequately trained to carry out assigned security responsibilities.

Policy Statement:

UT Austin ensures that personnel with specific security responsibilities receive role-based security training tailored to their functions, access level, and operational environment on CUI systems enrolled in CRSP.

UT Austin shall:

• Provide role-based security training prior to authorizing access to CUI systems, before performing assigned duties, and at least annually thereafter.
• Conduct additional training following significant system changes, updates to security policies, or other organization-defined events that impact user responsibilities or system security.
• Tailor training content to the specific duties and roles of personnel, including system administrators, developers, security assessors, acquisition staff, network personnel, and other personnel with access to CUI systems.
• Ensure the Controlled Research Support Program (CRSP) reviews and updates all role-based training materials annually, or sooner as needed, to reflect changes in systems, technologies, regulatory requirements, or lessons learned from incidents.

This policy reinforces UT Austin’s commitment to maintaining a security-aware workforce capable of protecting CUI and supporting compliance with NIST SP 800-171, NIST SP 800-53, DFARS 252.204-7012, and applicable federal and institutional standards.

The CRSP, or its designated representatives, are responsible for defining approved training paths, maintaining accurate training records, and reviewing course content to ensure alignment with institutional policies, federal regulations, and compliance requirements.

Responsible Departments, Tasks, and Frequencies Table:

NIST SP 800-171 Revision 2 to Revision 3 Change Analysis

CRSP Standard 3.3: Audit and Accountability (AU)

NIST SP 800-171 Rev. 3, Family 3.3

Purpose of Policy

The purpose of this policy is to establish a structured and comprehensive approach for implementing audit and accountability measures that support the security requirements defined in NIST Special Publication 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

This policy applies to all CUI systems enrolled in CRSP.

It defines the requirements for:

• Collecting, managing, and protecting audit records to ensure accountability and traceability of user and system activities;
• Ensuring audit logs capture sufficient detail to support security monitoring, incident investigations, and compliance reporting; and
• Establishing procedures for the review, retention, and protection of audit data in accordance with applicable federal regulations and institutional policies.

This policy provides the foundation for developing, implementing, and maintaining an audit and accountability program in compliance with the requirements of NIST SP 800-171.

Scope of Policy

applies exclusively to users, systems, networks, devices, services, and processes operating as part of or directly interacting with CUI systems enrolled in CRSP that process, store, or transmit Controlled Unclassified Information (CUI). This includes on-premises infrastructure, cloud-hosted services, and third-party platforms specifically authorized for CUI processing on CUI systems enrolled in CRSP.

This policy applies to all UT Austin personnel, contractors, sponsored researchers, foreign nationals (as authorized), and approved service providers who have authorized access to CUI systems. It also applies to any organizationally owned or personally owned device that is explicitly authorized to connect to or interact with CUI environments, subject to established authorization to access CUI systems, security configuration, and monitoring requirements.

Explicit Exclusions: This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated as part of a CUI system enrolled in CRSP.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CRECUI.
• Personally owned devices that do not connect to or access CUI environments.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

This policy establishes requirements for implementing and managing audit capabilities that ensure accountability, traceability, security monitoring, and compliance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy. The scope of this policy includes, but is not limited to, the following audit and accountability requirements:

Control Requirements

Departments and Responsibilities

Departments and responsibilities related to audit and accountability on CUI systems enrolled in CRSP are defined to ensure clear accountability and effective implementation of this policy. The table below outlines key roles and their associated responsibilities in accordance with applicable security requirements.

UT Austin CISO, in coordination with designated Information System Owners, is responsible for ensuring that all assigned roles and responsibilities remain accurate, current, and appropriate for the individuals or teams supporting CUI-related systems.

The table below outlines departments and their associated responsibilities, in accordance with applicable federal requirements and institutional security objectives:

Departments and Responsibilities

Senior Management Commitment

Senior management at the University of Texas at Austin (UT Austin) affirms its commitment to the effective implementation and ongoing oversight of the security principles and requirements established for CUI systems enrolled in CRSP.

UT Austin senior management supports the enforcement of this policy through the implementation of appropriate administrative, technical, and operational controls designed to protect CUI systems enrolled in CRSP. Senior management further commits to ensuring that adequate resources—including qualified personnel, supporting technologies, and necessary funding—are allocated to implement, operate, and continuously improve these controls.

This commitment reflects the University's recognition that strong cybersecurity governance and regulatory compliance are essential to safeguarding CUI information resources, protecting CUI, maintaining research integrity, and supporting the University's academic and research mission.

Policy Statement

The University of Texas at Austin (UT Austin) develops, documents, implements, and disseminates an Audit and Accountability Policy to ensure the generation, management, protection, and review of audit records necessary to support operational accountability, incident response, and compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy requirements.

The audit and accountability program on CUI systems enrolled in CRSP includes:

• Logging security-relevant events, including authentication, authorization decisions, privilege use, and system changes;
• Utilizing centralized logging solutions to collect, correlate, and analyze audit records across CUI systems enrolled in CRSP;
• Protecting audit logs through access controls, encryption, and technical safeguards;
• Routinely reviewing logs and alerts, identifying anomalies, and initiating incident response actions when needed;
• Retaining audit records for a minimum of one year, or longer as required by applicable legal, contractual, or institutional mandates.

The Chief Information Security Officer (CISO) is accountable for the development, approval, and periodic review of this Policy and its associated procedures, while Information System Owners (ISO) are responsible for its dissemination and implementation across their respective systems.

The AU Policy is reviewed at least once every three (3) years and AU Procedures are reviewed annually, and following:

• A significant security incident;
• Audit findings;
• Changes to regulatory or contractual obligations;
• System or infrastructure changes that affect logging capabilities.

Control Requirements

03.03.01 Audit Log Generation and Retention

Control Requirement:

1. Specify the following event types selected for logging within the system:

at a minimum and where applicable:

1) Authentication events:

a) Logons (Success/Failure)

b) Logoffs (Success)

2) Security Relevant File and Objects events:

a) Create (Success/Failure)

b) Access (Success/Failure)

c) Delete (Success/Failure)

d) Modify (Success/Failure)

e) Permission Modification (Success/Failure)

f) Ownership Modification (Success/Failure)

3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD)

(Success/Failure)

4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure)

5) User and Group Management events:

a) User add, delete, modify, disable, lock (Success/Failure)

b) Group/Role add, delete, modify (Success/Failure)

6) Use of Privileged/Special Rights events:

a) Security or audit policy changes (Success/Failure)

b) Configuration changes (Success/Failure)

7) Admin or root-level access (Success/Failure)

8) Privilege/Role escalation (Success/Failure)

9) Audit and security

10) System reboot, restart, and shutdown (Success/Failure)

11) Print to a device (Success/Failure)

12) Print to a file (e.g., pdf format) (Success/Failure)

13) Application (e.g., Adobe, Firefox, MS

1. Review and update the event types selected for logging at least every 12 months and after any significant incidents or significant changes to risks.

Policy Statement:

UT Austin establishes and enforces comprehensive event logging requirements to ensure the collection of security-relevant audit information necessary to support accountability, incident detection, and compliance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

UT Austin specifies the minimum set of event types that must be logged on all CUI systems enrolled in CRSP. These event types are required to support monitoring, forensic analysis, and the detection of unauthorized or anomalous activity. At a minimum and where applicable, systems must generate audit records for the following event categories:

1. Authentication Events
   • Logons (Success/Failure)
   • Logoffs (Success)
2. Security-Relevant File and Object Events
   • Create (Success/Failure)
   • Access (Success/Failure)
   • Delete (Success/Failure)
   • Modify (Success/Failure)
   • Permission modification (Success/Failure)
   • Ownership modification (Success/Failure)
3. Export/Write/Download Events to devices or digital media (e.g., USB, CD/DVD, SD cards) (Success/Failure)
4. Import/Upload Events from devices or digital media (Success/Failure)
5. User and Group Management Events
   • User add, delete, modify, disable, lock (Success/Failure)
   • Group/Role add, delete, modify (Success/Failure)
6. Use of Privileged or Special Rights
   • Security or audit policy changes (Success/Failure)
   • Configuration changes (Success/Failure)
7. Administrative or Root-Level Access (Success/Failure)
8. Privilege or Role Escalation (Success/Failure)
9. Audit and Security-Relevant Log Data Access (Success/Failure)
10. System Reboot, Restart, and Shutdown (Success/Failure)
11. Print to a Physical Device (Success/Failure)
12. Print to File (e.g., PDF) (Success/Failure)
13. Application Initialization Events (e.g., Adobe, Firefox, Microsoft Office) (Success/Failure)

UT Austin reviews and updates the required event types at least every 12 months and following any significant security incident or material change in system risk, ensuring audit logging remains aligned with current operational, regulatory, and threat landscape requirements.

Event logs must be generated consistently across all relevant systems, transmitted to centralized logging infrastructure where feasible, and protected from unauthorized access, modification, or deletion. All logging configurations and updates must support the confidentiality, integrity, and availability of CUI on CUI systems enrolled in CRSP and must reinforce UT Austin’s compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.03.02 User Accountability via Unique Identification

Control Requirement:

1. Include the following content in audit records:
2. What type of event occurred
3. When the event occurred
4. Where the event occurred
5. Source of the event
6. Outcome of the event
7. Identity of the individuals, subjects, objects, or entities associated with the event
8. Provide additional information for audit records as needed.

Policy Statement:

UT Austin establishes and enforces standardized audit record content requirements to ensure that all audit logs produced within CUI systems processing, storing, or transmitting CUI contain the information necessary to support accountability, incident detection, forensic analysis, and compliance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Systems must generate audit records that provide sufficient detail to accurately identify the nature, context, and impact of security-relevant events. At a minimum, each audit record must include:

1. Event Type — a description of what event occurred;
2. Timestamp — the date and time when the event occurred;
3. Event Location — the system, application, device, or component where the event took place;
4. Event Source — the origin of the event, such as the process, interface, user, or system generating the action;
5. Event Outcome — whether the event succeeded, failed, or generated a warning; and
6. Identity Information — the unique identifiers of individuals, subjects, objects, or other entities associated with the event.

UT Austin also requires CUI systems to capture additional contextual information as needed to support audit log analysis, investigations, and operational needs. Such supplemental information may include, but is not limited to, network addresses, session identifiers, process IDs, command execution details, and object path metadata, when these details enhance the value and interpretability of audit records.

All audit records must be generated consistently across relevant systems and retained in accordance with applicable retention policies. Audit content must be protected from unauthorized access, modification, and deletion to maintain the confidentiality, integrity, and availability of CUI on CUI systems enrolled in CRSP and support compliance with NIST SP 800-171.

Responsible Departments, Tasks, and Frequencies Table:

03.03.03 Audit Record Generation

Control Requirement:

1. Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02.
2. Retain audit records for a time period consistent with the records retention policy.

Policy Statement:

UT Austin ensures that all CUI systems processing, storing, or transmitting CUI generate audit records in accordance with the event types and audit record content defined in AU-03.03.01 and AU- 03.03.02. Audit record generation is a required capability of all applicable system components to support accountability, incident detection, forensic analysis, and continuous security monitoring.

Systems must be configured to:

• Generate audit records for all organization-defined security-relevant events, including authentication activities, privilege use, configuration changes, user and group management actions, and other events specified in AU-03.03.01.
• Include complete audit record content as defined in AU-03.03.02, ensuring each log record captures the required details needed to understand what occurred, when, where, by whom, and with what outcome.
• Transmit audit records to designated centralized logging repositories or security monitoring tools to support analysis and correlation activities.

Audit records must be retained for a period consistent with the institutional records retention policy, applicable federal requirements, and the UT Austin CRSP 3.0 CUI Governance Policy. Retention periods must ensure sufficient availability of log data for security investigations, compliance reporting, and operational needs. Audit records must remain protected against unauthorized access, modification, and deletion throughout their retention lifecycle.

This policy ensures that UT Austin maintains reliable, complete, and durable audit logging capabilities that support NIST SP 800-171 requirements and provide a trustworthy foundation for security oversight and incident response.

Responsible Departments, Tasks, and Frequencies Table:

03.03.04 Audit Logging Failure Alerts

Control Requirement:

1. Alert organizational personnel or roles within near real time or as soon as practicable upon discovery in the event of an audit logging process failure.
2. Take the following additional actions: document the failure and resolution, troubleshoot, repair/restart the audit logging process, and report as incident if applicable.

Policy Statement:

UT Austin detects, alerts on, and responds to failures in audit logging processes to ensure the integrity, availability, and reliability of audit records for CUI systems enrolled in CRSP. Audit logging capabilities must remain fully functional to support accountability, security monitoring, and incident investigation in alignment with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

System components must:

• Generate alerts in near real time, or as soon as practicable upon discovery, when audit logging processes fail, stop, reach capacity limits, become misconfigured, or otherwise cease to function as intended.
• Notify designated organizational personnel, including system owners, IT administrators, and security staff, so that prompt corrective action can be taken.
• Document all audit logging failures and corresponding resolutions, including timestamps, root cause analysis (when applicable), and corrective actions performed.
• Troubleshoot, repair, or restart failed audit logging services to restore normal operation as quickly as possible.
• Report the failure as a security incident when applicable, in accordance with the UT Austin Incident Response Plan (IRP), particularly if the failure results in the loss of audit data, degrades or disables monitoring capabilities, or indicates potential tampering or unauthorized modification of audit logging mechanisms.

These requirements ensure that UT Austin maintains continuous and trustworthy audit logging functionality and responds effectively to disruptions that may impede the detection of unauthorized activity or compromise of CUI systems.

Responsible Departments, Tasks, and Frequencies Table:

03.03.05 Audit Record Review, Analysis, and Reporting

Control Requirement:

1. Review and analyze system audit records at least weekly for indications and the potential impact of inappropriate or unusual activity.
2. Report findings to organizational personnel or roles.
3. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.

Policy Statement:

UT Austin establishes a structured process for the regular review, analysis, and reporting of system audit records to identify, evaluate, and respond to inappropriate or unusual activity within CUI systems enrolled in CRSP. This process supports accountability, risk management, and continuous situational awareness across the UT Austin environment in accordance with NIST SP 800- 171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Key requirements include:

• Review of Audit Records:
  • Audit records are reviewed at least weekly and after significant security incidents, system changes, or identified risks.
  • Reviews cover operating systems, applications, databases, network devices, and any other components generating audit logs relevant to CUI.
• Analysis and Correlation:
  • Audit logs are analyzed for indications of unusual, unauthorized, or potentially malicious activity.
  • Correlation of audit records across multiple systems and repositories is performed to identify patterns, detect potential incidents, and provide organization-wide situational awareness.
• Reporting Findings:
  • Identified anomalies, trends, or incidents are reported to responsible personnel, including the Chief Information Security Officer (CISO), Information System Security Officer (ISSO), and System Owners (ISOs).
  • Reports inform risk assessments, remediation actions, continuous monitoring activities, and compliance efforts.
• Documentation:
  • All reviews, analyses, and resulting actions are documented in the System Security Plan (SSP), Plan of Action and Milestones (POA&M), or other institutional records to support traceability, audit readiness, and evidence of compliance.

This policy ensures that UT Austin maintains proactive oversight of audit data, enables timely detection of potential threats or unauthorized activity, and supports comprehensive accountability and risk management for CUI systems.

Responsible Departments, Tasks, and Frequencies Table:

03.03.06 Audit Record Reduction and Report Generation

Control Requirement:

Provide audit record reduction and reporting to support on-demand analysis.

Policy Statement:

UT Austin implements structured processes and capabilities for audit record reduction and report generation to support effective review, analysis, reporting, and post-incident investigations of CUI systems enrolled in CRSP. These capabilities ensure that relevant information is efficiently accessible while preserving the integrity and completeness of original audit data in accordance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Key requirements include:

• Audit Record Reduction:
  • Audit records are filtered, summarized, or aggregated to produce manageable datasets for routine analysis, reporting, and trend identification without omitting critical security information.
  • Reduction processes maintain the fidelity of the original records, ensuring that no essential information for compliance, investigation, or accountability is lost.
• Report Generation:
  • Automated and manual reporting tools generate actionable audit summaries for system owners, ISSOs, CISO, and other stakeholders.
  • Reports include relevant security events, anomalous activity trends, and indicators of potential system compromise, supporting informed risk management and decision-making.
• Preservation of Original Records:
  • Original audit records are securely retained in their entirety, preserving content, sequence, and timestamps to support after-the-fact investigations, forensic analysis, and compliance verification.
  • Preservation methods ensure that records cannot be altered, deleted, or otherwise tampered with, maintaining accountability and traceability.
• Integration with Security Processes:
  • Reduced audit datasets and generated reports feed into the audit review, incident response, continuous monitoring, and compliance reporting processes.
  • Findings and reports are documented and maintained in the System Security Plan (SSP), Plan of Action and Milestones (POA&M), or institutional recordkeeping systems.

This policy ensures that UT Austin can efficiently review and analyze audit data, generate actionable reports, and conduct thorough post-incident investigations while maintaining the integrity, completeness, and traceability of audit records across CUI systems.

Responsible Departments, Tasks, and Frequencies Table:

03.03.07 Timestamps

Control Requirement:

1. Use internal system clocks to generate timestamps for audit records.
2. Record timestamps for audit records that meet a granularity of one (1) second or smaller and that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.

Policy Statement:

UT Austin ensures that all audit records generated for CUI systems enrolled in CRSP include precise and consistent timestamps to support accountability, traceability, and forensic analysis in accordance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Key requirements include:

• Time Source and Generation:
  • Internal system clocks are used to generate timestamps for all audit records.
  • Systems synchronize clocks with authoritative time sources to maintain accuracy and consistency across all information systems.
• Granularity and Format:
  • Audit records record timestamps with a granularity of one (1) second or finer to enable precise event sequencing and correlation.
  • Timestamps are expressed in Coordinated Universal Time (UTC), or include a fixed local time offset from UTC, ensuring clarity in multi-time zone environments.
• Integration and Preservation:
  • Timestamps are embedded within all audit logs, event records, and associated metadata.
  • The accuracy and integrity of timestamps are preserved during audit record reduction, report generation, storage, and retrieval to support incident investigations, compliance assessments, and accountability reviews.

This policy ensures that UT Austin maintains consistent, accurate, and verifiable time information across all audit records, supporting effective monitoring, forensic analysis, and compliance with federal and institutional CUI requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.03.08 Protection of Audit Information

Control Requirement:

1. Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
2. Authorize access to management of audit logging functionality to only a subset of privileged users or roles.

Policy Statement:

UT Austin ensures that all CUI system audit records, audit logs, and associated audit logging tools are safeguarded against unauthorized access, modification, and deletion to maintain the integrity, confidentiality, and reliability of audit data in accordance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Key requirements include:

• Access Controls:
  • Access to audit logs, audit records, and audit logging tools is restricted to authorized personnel with a defined need-to-know.
  • Only a limited set of privileged roles, such as the Information System Security Officer (ISSO), IT Administrators, and designated Security Operations staff, may manage, configure, or administer audit logging functionality.
• Data Protection:
  • Audit information is protected from unauthorized modification, deletion, or tampering through technical controls such as access control lists (ACLs), role-based access control (RBAC), encryption, and system permissions.
  • Backup and redundancy mechanisms are employed to ensure audit data is recoverable in the event of accidental deletion or system failure.
• Monitoring and Enforcement:
  • Systems regularly monitor attempts to access or modify audit information to detect potential unauthorized activity.
  • Violations of audit information protection policies are logged, investigated, and escalated in accordance with the incident response program.
• Documentation and Compliance:
  • All access and administrative actions related to audit logging functionality are logged and maintained for accountability.
  • Audit protection practices are reviewed periodically to ensure ongoing compliance with institutional policies and federal requirements.

This policy ensures the confidentiality, integrity, and availability of audit information and enforces strict access management to maintain a trustworthy and accountable audit environment for CUI systems.

Responsible Departments, Tasks, and Frequencies Table:

03.08.09 Withdrawn

Control Requirement: Incorporated into 03.03.08.

NIST SP 800-171 Revision 2 to Revision 3 Change Analysis

CRSP Standard 3.4: Configuration Management (CM)

NIST SP 800-171 Rev. 3, Family 3.4

Purpose of Policy

The purpose of this Configuration Management (CM) Policy is to establish a structured and comprehensive approach for implementing configuration management practices that support the security requirements defined in NIST Special Publication (SP) 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

This policy applies to all information systems, components, processes, and personnel within the University of Texas at Austin (UT Austin) environment that store, process, or transmit Controlled Unclassified Information (CUI) enrolled in CRSP.

This policy defines requirements for:

• Establishing and maintaining baseline configurations for information systems and components;
• Managing system changes through a controlled change management process, including documentation, approval, testing, and impact analysis;
• Enforcing the use of secure configuration settings and maintaining an accurate, up-to-date inventory of system components;
• Monitoring, reviewing, and controlling configuration drift to reduce vulnerabilities and maintain compliance with institutional, state, and federal requirements.

This policy provides the foundation for developing, implementing, and maintaining a configuration management program in compliance with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

Scope of Policy

This Configuration Management (CM) Policy applies to all information systems, components, personnel, and processes within University of Texas at Austin (UT Austin) that access, store, process, or transmit CUI on CUI systems enrolled in CRSP.

This policy encompasses:

• All cloud-based and on-premises environments where CUI is accessed, stored, processed, or transmitted;
• System components, including servers, endpoints, network devices, applications, firmware, and configuration repositories;
• All personnel involved in establishing, implementing, monitoring, reviewing, approving, or supporting configuration management activities;
• Processes governing the development, documentation, review, approval, deployment, and auditing of configuration changes.

Explicit Exclusions

This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated as part of a CUI system enrolled in CRSP.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CUI.
• Personally owned devices that do not connect to or access CUI environments.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

The CM Policy establishes requirements for identifying, managing, monitoring, and controlling changes to system configurations to ensure only authorized, documented, and approved configurations are applied.

This policy supports compliance with NIST SP 800-171, UT Austin CRSP 3.0 CUI Governance Policy, applicable Federal Information Processing Standards (FIPS), and other relevant regulatory obligations.

The scope of this policy includes, but is not limited to, the following configuration management requirements:

Control Requirements

Departments and Responsibilities

Departments and responsibilities related to configuration management on CUI systems enrolled in CRSP are established to ensure consistent application of secure configuration practices, proper change control, and system integrity.

The table below outlines key departments and their associated responsibilities in accordance with applicable federal requirements and institutional security objectives:

Departments and Responsibilities

Senior Management Commitment

Senior management at the University of Texas at Austin (UT Austin) affirms its commitment to the effective implementation and oversight of this Configuration Management Policy on CUI systems enrolled in CRSP.

Senior management supports the enforcement of this policy through the application of appropriate technical, managerial, and operational controls, and will ensure that sufficient resources, personnel, technology, and funding, are allocated to effectively implement and maintain these controls.

This commitment reflects the organization's recognition of the importance of cybersecurity and regulatory compliance in safeguarding information systems and supporting mission-critical operations .

Policy Statement

The University of Texas at Austin (UT Austin) maintains a comprehensive Configuration Management (CM) Policy to govern secure system configuration practices for protecting CUI systems enrolled in CRSP.

UT Austin:

• Defines secure configuration baselines and enforces configuration management requirements across CUI systems;
• Implements a formal change management process requiring review, approval, testing, documentation, and post-implementation validation;
• Conducts security impact analyses for configuration-controlled changes;
• Maintains accurate system inventories and documentation of locations housing CUI systems;
• Enforces least functionality by disabling unnecessary services, ports, and protocols;
• Continuously monitors for unauthorized configuration changes and implements corrective actions when deviations occur.

Support procedures are maintained for configuration baseline development, change approval workflows, configuration audits, deviation documentation, and security review processes.

The Chief Information Security Officer (CISO) is responsible for the development, approval, and periodic review of this policy. The Information System Owner (ISO) is responsible for implementing and disseminating this policy.

The policy is reviewed at least once every three (3) years, or sooner if required due to system changes, threat conditions, audit findings, or updates to regulatory requirements. Supporting operational procedures are reviewed annually to ensure continued alignment with current best practices, institutional requirements, and applicable state and federal mandates.

Control Requirements

03.04.01 Baseline Configuration

Control Requirement :

1. Develop and maintain under configuration control, a current baseline configuration of the system.
2. Review and update the baseline configuration of the system at least every 12 months and after any significant incidents or significant changes occur and when system components are installed or modified.

Policy Statement:

UT Austin develops, documents, and maintains baseline configurations for all CUI systems enrolled in CRSP. Baseline configurations include detailed specifications for hardware, software, firmware versions, standard security configurations, patch levels, and network topology necessary to ensure secure and consistent system operation.

UT Austin maintains all baselines under formal configuration control to ensure that only approved, authorized, and documented changes are implemented. Baseline configurations are reviewed and updated at least annually, and whenever system components are installed, upgraded, replaced, reconfigured, or otherwise modified in a way that could affect the system’s security posture.

Baseline documentation and inventories are maintained in alignment with NIST SP 800-128 and institutional configuration management procedures to ensure accuracy, traceability, and compliance with federal requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.04.02 Configuration Settings

Control Requirement:

Policy Statement:

UT Austin establishes, documents, and enforces secure configuration settings for all CUI systems enrolled in CRSP. Configuration settings reflect the most restrictive mode consistent with operational requirements and are developed using authoritative sources, including the National Institute of Standards and Technology (NIST) National Checklist Program (NCP), DISA Security Technical Implementation Guides (STIGs), and CIS Benchmarks.

UT Austin applies configuration settings to operating systems, applications, firmware, network devices, and endpoint components to ensure security controls are implemented consistently across CUI systems enrolled in CRSP. Remote devices connecting to UT Austin systems must not establish simultaneous connections to external networks through unauthorized channels.

Any deviation from approved configuration settings must be identified, documented, justified, and formally approved through the established change control and configuration management processes. All configuration deviations must include rationale, risk assessment, and mitigation actions.

This approach ensures configurations remain secure, standardized, and aligned with NIST SP 800-171, NIST SP 800-70, NIST SP 800-128, and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.04.03 Configuration Change Control

Control Requirement:

1. Define the types of changes to the system that are configuration-controlled.
2. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts.
3. Implement and document approved configuration-controlled changes to the system.
4. Monitor and review activities associated with configuration-controlled changes to the system.

Policy Statement:

UT Austin establishes and enforces a formal Configuration Change Control process for all CUI systems enrolled in CRSP. UT Austin identifies and defines the types of changes subject to configuration control, including but not limited to modifications to hardware, software, firmware, operating system settings, security configurations, network architecture, and established baseline configurations.

All proposed configuration-controlled changes must be reviewed, assessed for security and operational impact, and approved by the Change Control Board (CCB) or an authorized change authority before implementation. UT Austin requires that all approved changes be documented, tested in a controlled environment when feasible, and implemented according to established change management procedures. Unauthorized changes are prohibited and will be investigated.

UT Austin monitors and reviews all configuration-controlled change activities to ensure changes are implemented as approved, logged in an auditable system, and evaluated for potential security implications. Configuration change artifacts—including change requests, test results, approvals, implementation records, and post-implementation reviews—are retained in accordance with institutional requirements.

Responsible Departments, Tasks, and Frequencies Table:

03.04.04 Impact Analyses

Control Requirement:

1. Analyze changes to the system to determine potential security impacts prior to change implementation.
2. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.

Policy Statement:

UT Austin conducts formal security impact analyses for all proposed changes to CUI systems enrolled in CRSP. These analyses evaluate the potential effects of changes on system confidentiality, integrity, and availability, ensuring that all security requirements defined in NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy continue to be satisfied.

Impact analyses are required prior to the implementation of any configuration-controlled change, including modifications to hardware, software, firmware, network configurations, and access controls. Analyses are documented and reviewed to verify that post-change systems maintain compliance with security baselines, approved configuration settings, and institutional policies. Any identified risks are addressed through mitigation measures or change adjustments before approval and implementation.

This policy ensures that UT Austin maintains a secure, compliant, and resilient IT environment, minimizing the risk of unauthorized access, data compromise, or operational disruption resulting from system changes.

Responsible Departments, Tasks, and Frequencies Table:

03.04.05 Access Restrictions for Change

Control Requirement:

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Policy Statement:

UT Austin establishes, documents, and enforces both physical and logical access restrictions for all configuration management functions related to CUI systems enrolled in CRSP.

Access to configuration repositories, change control tools, and system configuration settings is limited to authorized personnel with a documented need-to-know, enforced through role-based access controls, multifactor authentication, and time-based or situational restrictions. Physical access to secure facilities or equipment housing configuration-critical components is controlled and monitored according to institutional policies.

All configuration-related activities are logged, and access privileges are reviewed periodically to ensure compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy. Unauthorized access attempts are investigated, and changes are permitted only during approved maintenance windows whenever feasible. This policy ensures that only qualified and authorized personnel can make or approve changes, maintaining system integrity, protecting CUI, and reducing the risk of unauthorized modifications.

Responsible Departments, Tasks, and Frequencies Table:

03.04.06 Least Functionality

Control Requirement:

1. Configure the system to provide only mission-essential capabilities.
2. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: Where feasible, organizations should limit component functionality to a single function per component. Organizations should consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations should employ network scanning tools, intrusion detection, and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality should also be achieved as part of the fundamental design and development of the system.
3. Review the system at least every 12 months, when any system functions, ports, protocols, or services changes are made, and after any significant incidents or significant changes to risks, to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
4. Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure.

Policy Statement:

UT Austin configures all CUI systems enrolled in CRSP to provide only mission-essential capabilities. Systems are deployed with minimal functionality required for operational objectives, and all nonessential functions, ports, protocols, connections, and services are disabled or removed.

UT Austin employs a layered approach to enforce least functionality, including:

• Using endpoint protection, host-based intrusion detection systems, firewalls, and network monitoring tools to identify and prevent unauthorized functions, connections, or services;
• Conducting periodic reviews of system functions, services, and configurations to identify and remediate unnecessary or nonsecure components;
• Integrating least functionality principles into system design, development, and procurement to reduce attack surfaces and mitigate potential security risks.

This policy ensures that only authorized and necessary capabilities are available on UT Austin systems, enhancing system integrity, reducing the risk of exploitation, and maintaining compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.04.07 Withdrawn

Control Requirement: Incorporated into 03.04.06 and 03.04.08.

03.04.08 Authorized Software – Allow by Exception

Control Requirement:

1. Identify software programs authorized to execute on the system.
2. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system.
3. Review and update the list of authorized software programs at least quarterly.

Policy Statement:

UT Austin enforces strict controls over the execution of software on CUI systems enrolled in CRSP. Only software explicitly identified and approved for use is authorized to execute on these systems.

UT Austin implements a deny-all, allow-by-exception approach to software execution using application control or whitelisting technologies. Key practices include:

• Maintaining an inventory of approved software programs authorized for execution;
• Validating approved software using cryptographic checksums or digital signatures to ensure integrity;
• Conducting integrity checks at system startup and/or during execution to detect unauthorized modifications;
• Reviewing and updating the list of authorized software programs at least quarterly or after any significant system or security event;
• Enforcing the policy across endpoints, servers, and other enterprise-managed systems to prevent execution of unauthorized or potentially harmful software.

This policy ensures the integrity of CUI systems enrolled in CRSP, reduces the risk of malware or unauthorized applications, and supports compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.04.09 Withdrawn

Control Requirement: Addressed by 03.01.05, 03.01.06, 03.01.07, 03.04.08, and

03.12.03.

03.04.10 System Component Inventory

Control Requirement:

1. Develop and document an inventory of system components.
2. Review and update the system component inventory at least quarterly.
3. Update the system component inventory as part of installations, removals, and system updates.

Policy Statement:

UT Austin maintains a comprehensive inventory of all system components that store, process, or transmit CUI on CUI systems enrolled in CRSP. The inventory includes, at a minimum, hardware, software, firmware, network devices, and associated system components. For each component, the inventory records manufacturer, model, serial number, version, configuration, licensing information, primary physical or virtual location, and ownership or custodianship information.

The system component inventory is reviewed and updated at least quarterly and whenever system components are installed, removed, or updated. Updates are documented to maintain accuracy and traceability. This inventory supports configuration management, security assessments, auditing, and compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy by providing visibility into the university’s information system landscape and ensuring accountability for all components.

Responsible Departments, Tasks, and Frequencies Table:

03.04.11 Information Location

Control Requirement:

1. Identify and document the location of CUI and the system components on which the information is processed and stored.
2. Document changes to the system or system component location where CUI is processed and stored.

Policy Statement:

UT Austin identifies and documents the physical and logical locations of all CUI and the CUI systems or system components enrolled in CRSP on which CUI is processed, stored, or transmitted. The locations include on-premises servers, cloud environments, network storage, endpoints, and portable devices.

Changes to the location of CUI or system components on CUI systems enrolled in CRSP are documented promptly to ensure that security, access controls, and compliance measures remain accurate and effective. Maintaining an up-to-date record of CUI locations supports accountability, traceability, and compliance with NIST SP 800-171 and UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.04.12 System and Component Configuration for High-Risk Areas

Control Requirement:

1. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: a configuration that has no CUI or FCI stored on the system and prevents the processing, storing, and transmission of CUI and FCI, unless a specific exception is granted in writing by the Contracting Officer.
2. Apply the following security requirements to the systems or components when the individuals return from travel: examine the system for signs of physical tampering and take the appropriate actions, and then either purge and reimage all storage media or destroy the system.

Policy Statement:

UT Austin enforces strict configuration management for systems and components issued to personnel traveling to high-risk locations to prevent unauthorized access, processing, or storage of Controlled Unclassified Information (CUI) or Federal Contract Information (FCI). Systems issued for travel are configured to minimize risk and protect institutional data while ensuring operational continuity.

This is enforced through the following procedures:

1. Travel System Issuance
   • All systems issued for travel to high-risk locations are preconfigured with no CUI or FCI stored unless a formal exception is documented and approved by the Contracting Officer.
   • Systems are deployed with:
   • Only mission-essential software installed.
   • Security configurations aligned with DISA STIGs, NIST SP 800-171, and UT Austin baseline settings.
   • Application whitelisting and endpoint protection enabled.
   • Network restrictions preventing external or unauthorized connections.
   • End users are provided instructions and training on system use, data handling restrictions, and reporting procedures during travel.
2. During Travel
   • Users must use only the approved system for travel.
   • Unauthorized software installation, modification of security settings, or introduction of CUI/FCI is prohibited.
   • Any anomalies, suspected compromise, or security incidents must be reported immediately to the ISSO and SOC.
3. Post-Travel System Handling
   • Upon return, the ISSO or designated personnel inspect the system for signs of physical tampering.
   • Systems are then either:
   • Purged and reimaged to baseline configurations, or
   • Destroyed if determined to be high-risk or compromised.
   • All actions, including inspections, purges, and reimaging, are documented in the configuration management records.
   • Systems that contained authorized CUI or FCI exceptions are verified against documentation and stored securely or destroyed per policy.
4. Operating System–Specific Implementation
   • Windows: Use BitLocker encryption for storage, Group Policy Objects (GPO) to enforce restrictions, and endpoint protection tools to prevent unauthorized installations.
   • Linux: Implement disk encryption (LUKS), SELinux/AppArmor policies, and package whitelisting.
   • macOS: Use FileVault, MDM-enforced security profiles, and application whitelisting to enforce travel system configurations.
5. DISA STIG Implementation
   • Apply relevant STIGs for endpoint hardening, account restrictions, network configuration, and application control to all travel systems.
   • Validate STIG compliance during pre-travel system provisioning and post-travel reimaging or inspection.
6. Audit and Compliance
   • Configuration management records for travel systems, including inspections, purges, reimages, and exceptions, are retained in the institutional CMDB for traceability and audit purposes.
   • Exceptions to the no-CUI policy require documented approval and risk assessment prior to travel.

Responsible Departments, Tasks, and Frequencies Table:

NIST SP 800-171 Revision 2 to Revision 3 Change Analysis

CRSP Standard 3.5: Identification and Authentication (IA)

NIST SP 800-171 Rev. 3, Family 3.5

Purpose of Policy

The University of Texas at Austin (UT Austin) establishes a structured and comprehensive framework for implementing Identification and Authentication (IA) practices to protect Controlled Unclassified Information (CUI) on CUI systems enrolled in CRSP. This policy supports the UT Austin CRSP 3.0 CUI Governance Policy and aligns with NIST SP 800-171 requirements.

UT Austin IA objectives include:

• User Identification and Authentication: Uniquely identify and authenticate users prior to granting access to CUI systems and re-authenticate users under organization-defined conditions.
• Device Identification and Authentication: Ensure that organizationally defined devices are uniquely identified and authenticated before connecting to systems.
• Multifactor authentication (MFA): Enforce MFA for all privileged and non-privileged accounts accessing CUI on CUI systems enrolled in CRSP.
• Replay-Resistant Authentication: Implement replay-resistant authentication mechanisms for all account types to prevent credential replay attacks.
• Identifier Management: Manage all user, device, service, and role identifiers, including assignment, authorization, uniqueness, and restrictions on reuse.
• Password Management: Maintain lists of known compromised passwords, enforce cryptographic protections, complexity requirements, and secure procedures for password creation and resets.
• Authentication Feedback: Obscure feedback during login attempts to prevent inadvertent disclosure of account or system information.
• Authenticator Management: Verify identity prior to issuing authenticators, protect authenticator content, manage lost or compromised authenticators, and enforce periodic changes as required.

This policy establishes the foundational requirements for designing, implementing, and maintaining secure identification and authentication mechanisms, ensuring the confidentiality, integrity, and availability of CUI within CUI systems.

Scope of Policy

This policy applies to all University of Texas at Austin (UT Austin) information systems, personnel, devices, and operational environments enrolled in CRSP that create, store, process, transmit, or otherwise handle Controlled Unclassified Information (CUI).

The scope encompasses:

• UT Austin-managed and third-party systems requiring user or device authentication prior to accessing CUI.
• User and device identification, authentication, and re-authentication, including password and authenticator management processes.
• Multifactor authentication (MFA) enforcement for privileged, remote, or non-local access.
• Replay-resistant authentication mechanisms to prevent credential capture, reuse, or spoofing.
• Identifier management processes for users, devices, services, and roles, including assignment, authorization, uniqueness, and reuse restrictions.
• Personnel responsible for IA implementation, operation, approval, or review, including system owners, administrators, and designated security staff.
• Protection of authentication information, including passwords, tokens, and cryptographic authenticators, from unauthorized disclosure or modification.

Explicit Exclusions This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated as part of a CUI system enrolled in CRSP.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CUI.
• Personally owned devices that do not connect to or access CUI environments.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

This policy ensures consistent, secure, and compliant Identification and Authentication practices aligned with NIST SP 800-171, the UT Austin CRSP 3.0 CUI Governance Policy, and applicable federal and institutional requirements.

The scope includes, but is not limited to, the following identification and authentication requirements necessary for secure access to CUI systems and protection of CUI:

Control Requirements

Departments and Responsibilities

Departments and responsibilities for Identification and Authentication (IA) on CUI systems enrolled in CRSP are defined to ensure accountability for the secure identification, authentication, and lifecycle management of users, devices, and systems. These assignments support the enforcement of user verification, multifactor authentication (MFA), credential management, authenticator protection, and identifier governance in alignment with NIST SP 800-171 Rev. 3, UT Austin CRSP 3.0 CUI Governance Policy, and applicable federal contractual requirements.

The table below outlines key roles and their associated responsibilities:

Departments and Responsibilities

Senior Management Commitment

Senior management at the University of Texas at Austin (UT Austin) affirms its commitment to the effective implementation and oversight of this Identification and Authentication (IA) Policy on CUI systems enrolled in CRSP.

Senior management supports the enforcement of this policy by ensuring the establishment and maintenance of appropriate technical, administrative, and procedural controls to secure user and system identification, credential management, and multifactor authentication (MFA). Leadership is responsible for providing sufficient resources—including qualified personnel, training, tools, and funding—to enable consistent implementation, monitoring, and continuous improvement of identification and authentication mechanisms across all CUI systems enrolled in CRSP.

This commitment reflects the University’s recognition of the critical role that secure identity verification, proper credential management, and MFA play in protecting CUI, mitigating insider and external threats, supporting compliance with federal and institutional requirements, and maintaining trust and operational integrity across research and enterprise environments.

Policy Statement

The University of Texas at Austin (UT Austin) establishes and maintains an Identification and Authentication (IA) Policy to ensure that system access is restricted to authorized individuals and that user identities are properly verified prior to granting access to CUI systems enrolled in CRSP.

This IA Policy addresses:

• Account provisioning, modification, and deprovisioning.
• Identity proofing and authentication before system access.
• MFA enforcement for all privileged accounts and remote access.
• Secure password practices, including complexity, expiration, account lockout, and session timeouts.
• Authenticator management, including issuance, revocation, and protection against unauthorized disclosure.

This policy is supported by detailed procedures that cover:

• Account provisioning, modification, and deprovisioning;
• Identity proofing and authentication prior to system access;
• Enforcement of multifactor authentication (MFA) for all privileged accounts, remote access, and non-local system access;
• Secure password practices, including complexity requirements, expiration, account lockout thresholds, and session timeout settings;
• Management of authenticators, including issuance, revocation, and protection against unauthorized disclosure or compromise.

The Chief Information Security Officer (CISO) is accountable for the development, approval, and periodic review of this Policy and its associated procedures, while Information System Owners (ISO) are responsible for its dissemination and implementation across their respective systems.

The IA Policy is reviewed at least once every three (3) years, and Planning Procedures are reviewed annually, and following:

• Significant changes to a system’s operational environment;
• Introduction of new technologies or major system updates;
• Security incidents affecting the confidentiality of CUI;
• Updates to federal security planning requirements or guidance;
• Findings from internal or external audits or assessments.
• This structured and auditable approach ensures that UT Austin maintains consistent, secure, and compliant identification and authentication practices, supporting the confidentiality, integrity, and availability of CUI.

Control Requirements

03.05.01 User Identification, Authentication, and Re-Authentication

Control Requirement:

1. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users.
2. Re-authenticate users when roles, authenticators, or credentials change (including modification of user privilege); when security categories of systems change; when the execution of privileged functions occurs; and after a session termination.

Policy Statement :

UT Austin uniquely identifies and authenticates all users accessing CUI systems enrolled in CRSP. Each user is assigned a unique institutional identity, and system access requires authentication using approved credentials. Shared or generic accounts are prohibited except where formally justified and authorized, ensuring all user actions can be attributed to an accountable individual.

UT Austin requires re-authentication under organization-defined circumstances, including but not limited to:

• Changes to roles, authenticators, or user credentials, including modification of privileges;
• Changes to the security categorization of systems;
• Execution of privileged functions; and
• After session termination.

All processes acting on behalf of users are associated with the initiating user account through system logs, session identifiers, and traceable records to maintain accountability and support auditability.

This policy ensures continuous validation of user identity, enforces accountability, and supports compliance with NIST SP 800-171 Rev. 3 Control Family 3.5 (Identification and Authentication) and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.05.02 Device Identification and Authentication

Control Requirement:

Uniquely identify and authenticate all devices for identification, where feasible for authentication, and document when not feasible, before establishing a system connection.

Policy Statement:

UT Austin enforces device identification and authentication to ensure that only authorized, trusted, and properly managed devices may connect to information systems that store, process, or transmit CUI.

Prior to establishing a system connection, UT Austin uniquely identifies and authenticates all organization-defined devices, wherever feasible, including but not limited to servers, workstations, laptops, mobile devices, virtual machines, research instruments, and network-connected assets. Instances where device authentication is not feasible shall be formally documented, and compensating controls shall be applied, as necessary.

UT Austin employs enterprise identity and access management technologies, such as device certificates, managed endpoint enrollment, cryptographic authentication, and centralized directory services, to verify device identity and ensure compliance with institutional security requirements. Devices that fail identity verification, do not meet configuration baselines, or cannot be authenticated are denied access to CUI systems.

This policy ensures that only properly authorized and fully managed devices participate in CUI workflows, supporting compliance with NIST SP 800-171, the UT Austin CRSP 3.0 CUI Governance Program, and applicable federal and institutional security standards.

Responsible Departments, Tasks, and Frequencies Table:

03.05.03 Multifactor authentication (MFA)

Control Requirement:

Implement multifactor authentication for access to privileged and non-privileged accounts.

Policy Statement:

UT Austin enforces multifactor authentication (MFA) for all privileged and non-privileged accounts accessing CUI systems enrolled in CRSP. UT Austin requires users to authenticate using at least two distinct factors, such as knowledge-based, possession-based, or biometric authenticators, before granting system access.

UT Austin prohibits the use of default, shared, or generic credentials in production environments and ensures all privileged access is managed, which mandates MFA for both local and remote administrative actions. Non-privileged users accessing enterprise or resources connected to CUI systems are subject to Conditional Access policies requiring MFA.

UT Austin ensures MFA is applied consistently across user accounts, sessions are bound to authenticated identities, and authenticator use is logged for auditing and accountability on CUI systems enrolled in CRSP. Device identity and endpoint security posture verification are implemented to further confirm trusted access to CUI systems.

Responsible Departments, Tasks, and Frequencies Table:

03.05.04 Replay-Resistant Authentication

Control Requirement:

Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

Policy Statement:

UT Austin implements replay-resistant authentication mechanisms for all privileged and non-privileged account access to CUI systems enrolled in CRSP. UT Austin ensures authentication exchanges cannot be captured and reused by adversaries by enforcing the use of cryptographically protected challenge-response mechanisms, time-bound authentication codes, and secure session establishment protocols.

UT Austin requires all authentication transactions to be protected using approved cryptographic standards and mandates the use of time-based one-time passcodes (TOTPs), cryptographic tokens, or other replay-resistant authenticators as defined in NIST SP 800-63B. Authentication sessions are uniquely bound to user identities and validated using non-reusable, verifier-protected secrets to ensure resistance to credential replay or interception.

UT Austin ensures replay-resistant authentication is consistently applied for both administrative and non-administrative access to CUI systems, and all associated authenticator use is logged to support auditability, accountability, and detection of unauthorized access attempts.

Responsible Departments, Tasks, and Frequencies Table:

03.05.05 Identifier Management

Control Requirement:

1. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier.
2. Select and assign an identifier that identifies an individual, group, role, service, or device.
3. Prevent the reuse of identifiers for at least ten (10) years.
4. Manage individual identifiers by uniquely identifying each individual as privileged or non-privileged users; contractors, foreign nationals, and/or non-organizational users.

Policy Statement:

UT Austin establishes and maintains a structured process for the assignment, management, and reuse prevention of identifiers for individuals, groups, roles, services, and devices that interact with CUI systems enrolled in CRSP.

UT Austin requires that:

• Authorization for Assignment: Identifiers are assigned only after receiving proper authorization from designated organizational personnel or roles.
• Identifier Selection and Assignment: Each identifier is uniquely selected and assigned to represent a specific individual, group, role, service, or device to ensure clear accountability and traceability.
• Reuse Prevention: Identifiers shall not be reused for a minimum period of ten (10) years to maintain identity uniqueness, prevent audit confusion, and preserve the integrity of access and activity records.
• Individual Identifier Management: Each individual is uniquely identified based on organizational-defined characteristics, including classification as privileged or non-privileged users, contractors, foreign nationals, or non-organizational users.

This policy ensures that identifier management practices support accountability, auditability, and traceability, and maintain compliance with NIST SP 800-171 Control Family 3.5 (Identification and Authentication) and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.05.06 Withdrawn

Control Requirement: Withdrawn Requirement

03.05.07 Password Management

Control Requirement:

1. Maintain a list of commonly-used, expected, or compromised passwords, and update the list at least quarterly and when organizational passwords are suspected to have been compromised.
2. Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords.
3. Transmit passwords only over cryptographically protected channels.
4. Store passwords in a cryptographically protected form.
5. Select a new password upon first use after account recovery.
6. Enforce the following composition and complexity rules for passwords:

1) Must have a minimum length of 16 characters.

2) Contains a string of characters that does not include the user’s account name or full name.

Policy Statement:

UT Austin establishes and maintains a structured Password Management program to ensure the secure creation, use, transmission, and storage of passwords for accounts accessing CUI systems enrolled in CRSP.

UT Austin requires that:

organizational passwords are suspected of being compromised.

• Password Validation: Passwords are verified against the maintained blacklist to prevent use of passwords that are commonly known, expected, or compromised during account creation or updates.
• Secure Transmission: Passwords must only be transmitted over cryptographically protected channels to prevent interception.
• Secure Storage: Passwords are stored in a cryptographically protected form to prevent unauthorized disclosure.
• First-Use Requirement: Users must select a new password upon first use following account recovery or reset.
• Password Composition and Complexity: Passwords must adhere to defined complexity requirements:
  • Minimum length of sixteen (16) characters.
  • Passwords must not contain strings that include the user’s account name or full name.

This policy supports UT Austin’s commitment to safeguarding CUI, mitigating risks associated with unauthorized access, and ensuring compliance with NIST SP 800-171 Rev. 3 Control Family 3.5 (Identification and Authentication) and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.05.08 Withdrawn

Control Requirement: Withdrawn Requirement

03.05.09 Withdrawn

Control Requirement: Withdrawn Requirement

03.05.10 Withdrawn

Control Requirement: Incorporated into 03.05.07

03.05.11 Authentication Feedback

Control Requirement:

Obscure authentication feedback to protect against unauthorized disclosure.

Policy Statement:

UT Austin implements mechanisms to obscure authentication feedback during the login process for CUI systems enrolled in CRSP.

UT Austin requires that:

1. Input Masking: Passwords and other sensitive authentication inputs are masked on-screen to prevent observation by unauthorized individuals.
2. Vague Error Messages: Authentication failure messages are intentionally generic (e.g., “Invalid credentials”) and do not indicate whether the username, password, or other factor was incorrect, thereby preventing disclosure of system or account information.
3. Consistent Feedback Controls: All authentication interfaces provide consistent feedback across systems to minimize information leakage and reduce the risk of unauthorized access.

This policy supports UT Austin’s commitment to protecting CUI, mitigating risks of unauthorized disclosure, and ensuring compliance with NIST SP 800-171 Rev. 3 Control Family 3.5 (Identification and Authentication) and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

03.05.12 Authentication Management

Control Requirement:

1. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.
2. Establish initial authenticator content for any authenticators issued by the organization.
3. Establish and implement administrative procedures for initial authenticator distribution; for lost, compromised, or damaged authenticators; and for revoking authenticators.
4. Change default authenticators at first use.
5. Change or refresh authenticators never for passwords where MFA is employed, at least every five (5) years for hard tokens and identification badges, and at least every three (3) years for all other authenticators or when the following events occur: after a relevant security incident or any evidence of compromise or loss.
6. Protect authenticator content from unauthorized disclosure and modification.

Policy Statement:

UT Austin establishes and maintains a structured program for the management of authenticators to ensure secure access to CUI systems enrolled in CRSP.

UT Austin requires that:

1. Identity Verification: The identity of any individual, group, role, service, or device receiving an authenticator is verified prior to initial distribution.
2. Initial Authenticator Content: All authenticators issued by UT Austin are initialized with secure content according to institutional standards.
3. Administrative Procedures: Formal procedures are implemented for the distribution of initial authenticators, and for the revocation, replacement, or recovery of lost, compromised, or damaged authenticators.
4. Default Authenticator Changes: All default authenticators must be changed upon first use to prevent unauthorized access.
5. Authenticator Refresh or Change: Authenticators are changed or refreshed in accordance with the organization-defined frequency:

• Passwords protected by MFA: not routinely changed.
• Hard tokens and identification badges: at least every five (5) years.
• All other authenticators: at least every three (3) years, or upon relevant security events, including suspected compromise or loss.

1. Protection of Authenticator Content: All authenticators are protected against unauthorized disclosure, modification, or misuse throughout their lifecycle.

This policy ensures that UT Austin maintains robust access control, mitigates risks associated with unauthorized use of authenticators, and supports compliance with NIST SP 800-171 Rev. 3 Control Family 3.5 (Identification and Authentication) and the UT Austin CRSP 3.0 CUI Governance Policy.

Responsible Departments, Tasks, and Frequencies Table:

NIST SP 800-171 Revision 2 to Revision 3 Change Analysis

CRSP Standard 3.6: Incident Response (IR)

NIST SP 800-171 Rev. 3, Family 3.6

Purpose of Policy

The purpose of this policy is to establish a structured and comprehensive framework for implementing and maintaining incident response capabilities in support of the security requirements defined in NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and the UT Austin CRSP 3.0 CUI Governance Policy.

This policy applies to all information systems, personnel, contractors, service providers, and organizational units within the University of Texas at Austin (UT Austin) environment that store, process, or transmit Controlled Unclassified Information (CUI) enrolled in CRSP.

This policy establishes requirements for:

• Developing, implementing, and maintaining a formal incident response program that addresses preparation, detection, analysis, containment, eradication, recovery, and post-incident activities for security events affecting CUI and other sensitive institutional data.
• Ensuring timely identification, reporting, documentation, escalation, and management of security incidents in accordance with institutional requirements, applicable federal obligations (including NIST SP 800-171 and federal research sponsor requirements), and the UT Austin CRSP 3.0 CUI Governance Policy.
• Conducting incident response training, tabletop exercises, simulations, and testing activities to validate operational readiness, strengthen coordination across stakeholders, and meet state and federal cybersecurity expectations.
• Documenting incident details, response actions, lessons learned, and corrective measures to support continuous improvement, enhanced resilience, and ongoing risk mitigation.
• Coordinating incident response activities with appropriate internal stakeholders, senior management, third-party service providers, regulatory authorities, and federal partners, as required by applicable laws, regulations, and contractual obligations.

Scope of Policy

This Incident Response Policy applies exclusively to information systems, system components, personnel, contractors, service providers, and operational processes associated with CUI systems enrolled in CRSP.

The scope of this policy encompasses:

• All on-premises, hybrid, and cloud-based systems and infrastructure enrolled in CRSP that store, process, or transmit CUI and support the detection, reporting, analysis, containment, eradication, or recovery from cybersecurity incidents affecting such systems.
• All CUI system components, including servers, workstations, mobile devices, applications, databases, network infrastructure, logging and monitoring platforms, endpoint protection technologies, and cloud-native services that support or impact systems handling CUI.
• All personnel and third-party entities with responsibilities related to CUI systems that process CUI, including identifying, reporting, triaging, analyzing, responding to, or escalating potential or confirmed security incidents. This includes, but is not limited to, Information System Owners

(ISOs), Information System Security Officers (ISSOs), system administrators, Security Operations personnel, managed service providers, and designated incident response team members supporting CUI systems enrolled in CRSP.

• All processes associated with the incident response lifecycle for CUI systems handling CUI, including preparation, detection, analysis, containment, eradication, recovery, evidence preservation, reporting, coordination, and post-incident review activities.

Explicit Exclusions:

This policy does not apply to:

• General university enterprise systems that do not process, store, or transmit CUI.
• Institutional administrative systems (e.g., HR, finance, student information systems) unless those systems are formally designated as part of a CUI system enrolled in CRSP.
• General-purpose IT services such as standard email, collaboration platforms, learning management systems, or campus network services that are not configured or authorized for CUI processing.
• Public-facing university websites or research systems that do not contain CUI.
• Personally owned devices that do not connect to or access CUI environments.

Systems or services may only fall under this policy if they have been formally designated, documented, and authorized as part of the applicable CUI system boundary in accordance with institutional CUI governance procedures.

This policy establishes the baseline requirements for implementing and enforcing access controls within the applicable CUI system boundary in accordance with NIST SP 800-171 and UT Austin CRSP Standard 3.0: CUI Governance. These requirements include, but are not limited to:

Control Requirements

Departments and Responsibilities

Departments and responsibilities for incident response on CUI systems enrolled in CRSP are formally defined to ensure accountability for the timely detection, reporting, analysis, containment, eradication, recovery, and documentation of cybersecurity incidents affecting systems that store, process, or transmit Controlled Unclassified Information (CUI).

These assignments support the implementation and enforcement of the UT Austin Incident Response Plan and associated procedures for CUI systems and are aligned with NIST SP 800-171 and the UT Austin CRSP 3.0 CUI Governance Policy.

The following departments are applicable to CUI systems handling CUI:

Departments and Responsibilities