SA-1: System and Services Acquisition – Policy and Procedures
NIST Baseline: Low
Privacy Baseline: Yes
DIR Required By: 07/20/2023
Review Date: 08/01/2024
Purpose –
The System and Services Acquisition Policy and associated controls help ensure that systems, system components, and services that are acquired are compliant with Tarleton State University (Tarleton) information security standards and are compatible with existing information resources, have sufficient documentation, and are an efficient use of funds.
Scope and Roles –
This policy applies to information resources owned or managed by Tarleton. The intended audience includes all involved in hiring and personnel management, the Tarleton Chief Information Officer (CIO), Chief Information Security Officer (CISO), and information resource owners and custodians.
Compliance –
System and Services Acquisition controls are implemented to ensure compliance with the Texas Department of Information Resources (DIR) Security Control Standards Catalog as required by Title 1 Texas Administrative Code (TAC) §202.76, and Texas A&M University System (TAMUS) Regulation 29.01.03, Information Security.
Implementation –
- The Tarleton CISO, in coordination with information resource owners and custodians, shall develop, document, and disseminate a set of controls that addresses the system and services acquisition of information resources. These controls should:
- Address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Be consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
- Information resource owners and custodians are responsible for any procedures to facilitate the implementation of the System and Services Acquisition controls in order to ensure proper system and services acquisition;
- The Tarleton CISO, or their designee, shall review and update the System and Services Acquisition controls as necessary.