Excessive/improper use of a resource, or intentional destruction, diversion, manipulation, misapplication, or misuse of resources.

Providing electronic information and services through multiple ways so that communication is not contingent on a single sense or ability.

Describes an electronic information resource that can be used in a variety of ways and does not depend on a single sense or ability.

Chief Information Security Officer

A document or paper trail showing the seizure, custody, control, transfer, analysis and disposition of physical and electronic evidence.

Records, files, reports and other data or material relating to contracts between the system (and by extension the university) and the U.S. Government which are required by the contract, pursuant to Executive Order 12356 April 2, 1982, updated by Executive Order 13526, to be protected against unauthorized disclosure in the interest of national security.

Cloud computing has the meaning assigned by Special Publication 800-145 issued by the United States Department of Commerce National Institute of Standards and Technology: a model for enabling access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort. Cloud computing service models include Infrastructure as a Service, Platform as a Service, and Software as a Service.

Collaborative computing devices include, but are not limited to, networked white boards, cameras, and microphones. Collaborative computing devices often have the capability to transmit audio, video, or images from their installed location across a network.

Collection is the act of gathering ESI for further use in the E-Discovery process (process, review, etc).

The Common Vulnerability Scoring System (CVSS) is a standard metric to capture the principal characteristics of a vulnerability, and produce a numerical score reflecting its severity.  The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.

The third of four university data classification levels. Confidential Data is restricted because of legal, ethical, or contractual constraints, and should not be accessed without specific authorization. Improper release of data in this category would have a significant adverse impact to the university. Data in this category is often specifically protected by federal or state law, and may be subject to state or federal breach notification requirements. Data in this category is generally not subject to release under open records laws. See security control DC-5.

Management policy and procedures used to guide an enterprise response to a perceived loss of mission capability. The Contingency Plan is the first plan used by the enterprise risk managers to determine what happened, why, and what to do. It may point to the continuity of operations plan (COOP) or disaster recovery plan (DRP) for major disruptions.

The ability of an organization to provide service and support for its customers and maintain its viability before, during, and after a business continuity event.

Division Risk Assessment Coordinator. A liaison between his/her college or division and Technology Services Risk Management and Policy (IT-RMP) concerning the annual IT risk assessment process. Responsible for coordinating/managing the IT risk assessment process (outlined in the Information Security Risk Assessment Procedures) for the college or division. This includes:

• Ensuring there is an accurate inventory list of all information resources for the college or division
• Coordinating with and assisting staff and faculty within the college or division to accurately perform an information security risk assessment for their information resources
• Consulting with IT-RMP to add the information and complete the on-line assessment process using the provided IT risk assessment tool
• Monitoring the progress of all assessments for the college or division from beginning to completion to ensure due dates are met

The number of D-RACs per college or division is determined by IT-RMP, in consultation with the college or division, based on the IT environment.

Typically information technology professionals who manage the information systems that store and process university data. Data Custodians develop and implement technology infrastructure to support the functional needs of a data domain, and implement technical security controls to ensure the confidentiality, integrity, and availability of their data under their care.

An individual responsible for the quality and integrity of a defined dataset on a day-to-day basis. Data Managers evaluate and authorize requests for access to the data, and are responsible to protect the data from misuse or mismanagement. Data Managers are assigned these responsibilities by a Data Steward over a particular data domain, and may act as a delegate of the Data Steward for routine purposes.

An individual with a role title related to representing information—usually for a specific information type, business sector, or business function—for university-wide information governance purposes. Data Stewards are institutional officers and have management and policy-making authority over their specific data subject areas, including the business definitions of data, and the access and use of that data across the university.

Any individual (student, employee, or affiliate of the university) who interacts with university data.

Information created by a computer system or other information resource that is electronically captured and relates to the operation of the system and/or movement of files, regardless of format, across or between a computer system or systems. Examples of captured information are dates, times, file size and locations sent to and from.

A certificate, as defined in Texas Administrative Code, Chapter 203, Subchapter A, §203.1, issued by a business unit for purposes of electronic commerce.

A questionnaire to be filled out by the named person. The hold questionnaire will list examples of the common types of places where relevant ESI might be stored, and will ask the named person to identify where the named person has relevant ESI stored in those types of places.

The individual responsible for facilitating university IT Preservation Hold activities and acts as a liaison to the Office of General Counsel on behalf of the Institution.

An electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record (Texas Business and Commerce Code 322.002).

Electronically Stored Information, or ESI, is a broad term applicable to all information stored electronically, however, email communication and files are the most common types of ESI.

The process by which plain text information is converted to a form not readable by humans (i.e., ciphertext) through the use of a mathematical process (encryption algorithm) and a parameter (encryption key).

As defined by NIST Special Publication 800-111, an End User Device is a personal computer (desktop or laptop), consumer device (e.g., personal digital assistant, smart phone), or removable storage media (e.g., USB flash drive, memory card, external hard drive, writable CD or DVD) that can store information.

Defined in the Institutional Continuity Plan (Annex J) as functions that must be either Uninterrupted or resumed within a few hours of an incident.

Essential Functions support:

• Emergency Response Services,
• Utilities to include electricity, water, and reasonable climate control,
• Communications with internal and external audiences to include students, faculty, staff and the media,
• Internet, authentication, and voice communications,
• Hazardous materials spill response and control, to include safe handling and proper disposal of toxic substances, biologically hazardous materials, and radioactive materials.

An IT service with a Recovery Time Objective of less than 12 hours and one required to support the critical infrastructure functions of the university.

Federal Information Processing Standards

Refer to the University Catalog (http://catalog.tamu.edu//), pages 1039-1040 for definitions regarding FERPA.

The section of Google Apps Suite where Gmail and Google Drive data can be placed on hold.

Information Resources whose loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. Such an event could:

    (A) cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions;

    (B) result in major damage to organizational assets;

    (C) result in major financial loss; or

    (D) result in severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries.

A common term used by OGC and email platforms alike to refer to the act of preserving ESI.

Department/unit-level plan that is focused on the overall recovery of Electronic Information Resources supported by the department/unit.

Made up of a combination of information technology, people, and processes. A customer-facing IT service directly supports the business processes of one or more customers. Other IT services, called supporting services, are not directly used by the business, but are required by the service provider to deliver customer-facing services.

Identification is the act of locating potential sources of ESI & determining its scope, breadth & depth.

A feature of Microsoft Exchange, introduced in Microsoft Exchange 2013, that places mailboxes on hold within the platform. In-Place Holds are the preferred method of placing user mailboxes on hold.

A person responsible for implementing owner-defined controls and access to an information resource. Custodians may include university employees, vendors, and any third party acting as an agent of – or otherwise on behalf of – the university and/or the owner.

An individual or automated service authorized to access an information resource in accordance with the owner-defined controls and access rules.

The procedures, computer equipment, computing facilities, software and data which are purchased, designed, built, operated and maintained to collect, record, process, store, retrieve, display, report and transmit information.

A situation declared as a crisis by designated Technology Services personnel.

Establishes procedures to recover a Mission Critical Electronic Information Resource or Essential IT Service or a grouping of interdependent IT Services following a disruption.

Any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. The term includes computers (including desktop and laptop computers), ancillary equipment, desktop software, client-server software, mainframe software, web application software and other types of software, firmware and similar procedures, services (including support services), and related resources (TAC 213.1 (9)).

A model of Cloud Computing that allows a consumer of the service to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls) (NIST 800-145 September 2011).

The risk that an activity/event would pose if no controls or other mitigating factors were in place (the gross risk or risk before implementation of controls).

A company that provides access to the internet.

Web page that a state agency or institution of higher education has specifically designed for members of the general public to access official information (e.g., the governing or authoritative documents) from the agency or institution of higher education. A list of these pages can be found at http://itaccessibility.tamu.edu/requirements/kpep.php.

A feature introduced in Microsoft Exchange 2010 that places mailboxes on hold within the platform. This type of hold is gradually being phased out on TAMU Exchange.

Information Resources whose loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. Such an event could:

    (A) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced; 

    (B) result in minor damage to organizational assets; 

    (C) result in minor financial loss; or 

    (D) result in minor harm to individuals.

An end user device that is configured to allow Texas A&M Technology Services to discover, maintain, and control the device.

Refers to any issue handled by OGC that requires the preservation and potential production of ESI. A matter might be a lawsuit that has been filed, or the reasonable anticipation of litigation.

Materials that hold data in any form or allow data to pass through, including paper, transparencies, multipart forms, hard/floppy/optical disks, magnetic tape, wire, cable and fiber.

Information resources defined by the owner (or by the university in the case of Essential IT Services) to be crucial to the continued performance of the mission of the department/unit. Unavailability of such information resources would result in more than an inconvenience. An event causing the unavailability of mission-critical information resources would result in consequences such as: significant financial loss, institutional embarrassment, failure to comply with regulations or legal obligations, or closure of the department/unit.

As defined by NIST Special Publication 800-124, a mobile device is a portable computing device that: (i) has a small form factor such that it can easily be carried by a single individual; (ii) is designed to operate without a physical connection (e.g., wirelessly transmit or receive information); (iii) possesses local, non-removable or removable data storage; and (iv) includes a self-contained power source. Mobile devices may also include voice communication capabilities, on-board sensors that allow the devices to capture information, and/or built-in features for synchronizing local data with remote locations.

Information Resources whose loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. Such an event could:

    (A) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced;

    (B) result in significant damage to organizational assets;

    (C) result in significant financial loss; or

    (D) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

Refers to any person who has been asked to preserve ESI as part of a preservation hold.

OGC refers to The Texas A&M University System - Office of General Counsel.

Storage in a separate facility that is not co-located with the operational system.

Computer software, other than computer and network operating systems, with a primary function of allowing the computer on which the software is used to designate files available for transmission to another computer using the software, to transmit files directly to another computer using the software, and to request transmission of files from another computer using the software.

Information that alone — or in conjunction with other information — identifies an individual, including an individual's name, social security number, date of birth, or government-issued identification number; mother's maiden name; unique biometric data, including the individual's fingerprint, voice print, and retina or iris image; unique electronic identification number, address, or routing code; and telecommunication access device as defined by Section 32.51, Texas Penal Code.

A model of Cloud Computing that allows a consumer of the service to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment (NIST 800-145, September 2011).

Preservation is the act of ensuring ESI is protected against inappropriate alteration or destruction

A notice from OGC to one or more persons (the “named persons”) and the institution for which they work to preserve documents and ESI pursuant to a matter. The short “hold” may be used in this context, however, that term is not contextually specific alone.

The document OGC sends to a person placing that person under a preservation hold. The preservation letter describes the documents and ESI to be preserved.

Employees of an Institution with roles and duties important to the preservation effort. Preservation personnel typically include employees involved with employee hiring/transfer/termination, such as the Human Resources Director and the Provost. It also typically includes IT people responsible for the automatic purging of accounts and deletion of data, such as email administrators, account administrators, desktop technicians, and the help desk.

Any patient information, including very basic information such as name or address, that (1) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and (2) either identifies the individual or could reasonably be used to identify the individual.

The lowest university data classification level. Public Data is openly available to the public. This may include low-sensitivity data which is openly distributed and presents no risk to the university, such as official university communications and public announcements. Most data hosted on publicly-accessible websites falls into this classification level. Few restrictions are placed on this type of data. See security control DC-3.

Removable computer media includes digital media such as, but not limited to, diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, and optical disks.
This also applies to portable and mobile computing and communications devices with information storage capability (e.g., notebook computers, tablets, smart phones).

A salt is a random number of a fixed length that is concatenated (i.e., linked to) to the password before the digest operation. This salt must be different for each stored entry. It must be stored as clear text next to the hashed password.

Electronic system for reporting (after the fact, after- action) incidents in compliance with Texas Department of Information Resources (DIR) regulations.

Security Operations (SecOps) is a team of experienced security professionals and technicians with the authority and expertise to resolve a system incident. Security Operations reports into the Office of the CISO as part of Texas A&M Technology Services, and has the responsibility to investigate, analyze available data, and resolve security incidents.

An information security incident is considered significant if it meets one or more of the following criteria: involves actual or suspected unauthorized disclosure of confidential information; involves consequential legal issues; may cause severe disruption to unit mission-critical services or university wide Essential IT services; involves active threats; is widespread; is likely to raise public interest.

A computer program that provides the instructions enabling the computer hardware to work. System software, such as Windows or MacOS, operate the machine itself, and applications software, such as spreadsheet or word processing programs, provide specific functionality.

A model of cloud computing that allows a consumer of the service to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings (NIST 800-145, September 2011).

Security incident that results in the transfer of data onto an information resource with a lower level of data classification (see DC-1), or onto an information resource that is not authorized to store or process that information.

Software installed without the user's knowledge or permission to capture and reveal information to someone outside the computer system. It can do such things as capture keystrokes while typing passwords, read and track email, record sites visited, and pass along credit card numbers. It can be installed by Trojan horses or viruses, installed as part of freeware or shareware programs that are downloaded and executed, or installed by advertising agencies to assist in sending targeted advertising to a computing device.

Established to manage and mitigate risk through development and support of project management knowledge, processes and tools for the university. The Technology Services Project Management Office (PMO) has been assigned by the Vice President for Information Technology and Chief Information Officer to be responsible for publishing guidelines on and assisting with monitoring the effectiveness of information resource project and portfolio management practices at the university.

Limited to Essential IT Services supporting essential functions as defined by Institutional Continuity Plan (Annex J) of the Texas A&M University Emergency Operation Plan. Organizations that support Essential IT Services shall maintain their own procedures and actively participate in the training, exercise, and maintenance needed to support this plan.

Builds on Institutional Continuity Plan (Annex J) of the Texas A&M University Emergency Operation Plan by providing guidance and templates to relate a business function's Recovery Time Objective (RTO) and Recovery Point Objective (RPO) to the IT services that support department/unit business functions.

A Texas A&M University (TAMU) owned, operated by/or for, or funded Web site connected to the internet, including the home page and any key public entry points.

An individual or organization separate from the two principals involved. A third party is typically a company that provides an auxiliary product or service not provided by the primary supplier to the end user (the two principals).

Data or information that is stored, processed, or transmitted on any information resource where university business occurs, including data in the possession or under the control of an individual by virtue of that person’s employment or affiliation with the university. This includes, but is not limited to, all university information resources, resources owned or managed by state agencies, or resources owned or managed by third parties (e.g., business associates, cloud service providers, vendors, or contractors).

The second of four university data classification levels (formerly Controlled). University-Internal Data may be accessed by eligible employees in the course of university business. This information is not generally created for or made available for public consumption, but it may be subject to public disclosure through the Texas Public Information Act or similar laws. Such data must be appropriately protected to ensure lawful release. See security control DC-4.

Web design criteria which support user performance, ease of navigation and understandability.

Individual or entity who has a contract with the university to provide goods or services for compensation. This term excludes contract employees.

World Wide Web Consortium; an international community that develops open standards to ensure the long-term growth of the Web.