Tarleton State University

IT hardware and software systems.  

This includes:  

• data,  
• equipment, facilities, and software, that create, process, store, retrieve, display, or transmit data, and  
• any computer-related activities involving any device capable of receiving, storing, managing, or transmitting data.  

Examples include: mainframes, servers, network infrastructure, desktop and laptop computers, IP phones, printers, web applications and cloud services.  

The executive responsible for information resources across the institution as defined in Chapter 2054, Subchapter D, Texas Government Code.  This is the Tarleton Chief Information Officer (CIO).  

The person legally or operationally responsible and accountable for the data and/or business function supported by an information resource.   

• The Owner determines controls and access to information resources supporting that business function.  
• Typically, this is a department head and may be the person responsible for the procurement, development, operation, and maintenance of an information resource.  

An individual, department, institution, or third-party service provider responsible for supporting and implementing owner-defined controls to information resources.  Custodians include information technology units, staff, vendors, and any third-party acting as an agent of or otherwise on behalf of the Tarleton Office of Innovative Technology Solutions.  

Information and information resources that are essential to the mission and operations of the Texas A&M University System or Tarleton State University (Tarleton).   

Loss or disruption to the confidentiality, integrity, or availability of a High Impact Information Resource would result in a severe or catastrophic adverse effect on organization operations, assets, or individuals. Such an event could:  

1. Cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions;  

2. Result in major damage to organizational assets;  

3. Result in major financial loss; or  

4. Result in severe or catastrophic harm to individuals involving loss of life or serious life-threatening injuries.  

This term equates to HIGH impact in the Federal Standards for Security Categorization of Federal Information and Information Systems, FIPS 199.   

A risk assessment should be completed annually on these types of information systems.  

Information and information resources whose loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.  Such an event could:  

1.  Cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced;  

2.  Result in significant damage to organizational assets;  

3.  Result in significant financial loss; or  

4.  Result in significant harm to individuals that does not involve loss of life or serious life-threatening injuries.  

A risk assessment should be completed every two years on these types of information systems. 

Information and information resources whose loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. Such an event could:  

1.  Cause a degradation in mission capability to an extent and duration that the organization can perform its primary functions, but the effectiveness of the functions is noticeably reduced;   

2.  Result in minor damage to organizational assets;   

3.  Result in minor financial loss; or  

4.  Result in minor harm to individuals. 

A risk assessment should be completed every three years on these types of information systems.