Standards for Technologies Prohibited by Regulation

Regulatory Source: Prohibited Technologies

On February 6, 2023, the Governor released a model plan as required by a December 7, 2022, directive banning all state agencies from using TikTok on government-issued devices. This model plan included additional prohibited technologies and detailed objectives intended to protect the state’s information resources and infrastructure. The model plan requires each state agency to develop its own policies and procedures to implement the plan and its objectives.

To learn more, refer to the following pages:

• Governor’s December 7, 2022, Announcement
• Governor’s December 7, 2022, Directive 
• Governor’s February 6, 2023, Announcement
• DIR’s List of Covered Applications and Prohibited Technologies
• Texas State University System's Technologies Prohibited by Regulation Policy

Regulatory Source: Covered Applications

Effective June 14, 2023, Texas Government Code Chapter 620 requires state agencies to prohibit the installation or use of Covered Applications on any device owned or leased by the governmental entity and requiring the removal of Covered Applications from those devices. Covered Applications are social media applications or services specified by proclamation of the Governor under Sec. 620.005.

To learn more, refer to the following pages: 

• Texas Government Code Chapter 620. Use of Certain Social Media Applications and Services on Governmental Entity Device Prohibited 
• The TSUS Technologies Prohibited by Regulation Policy
• Governor's January 31, 2025, Proclamation

All college Personnel are prohibited from:

• Downloading or using any Prohibited Technologies or Covered Applications on college-owned devices;
• Conducting College Business on personally owned devices with Prohibited Technologies installed;
• Entering Sensitive Locations with a Prohibited Technology-enabled personal device; and/or
• Acquiring or reimbursing the purchase of Prohibited Technologies.

Exceptions for Covered Applications

Exceptions for Covered Applications may only be approved to enable law enforcement or information security measures. No other exceptions may be authorized for Covered Applications. 

Exceptions for Prohibited Technologies

Pursuant to the Governor’s directive, exceptions for Prohibited Technologies may be approved only by the college’s president.

Exceptions for Investigations

The following exceptions are legitimate uses of Prohibited Technologies for the express purpose of performing investigations required by state, federal, or industry regulations:

• Law-enforcement investigations
• Cybersecurity incident investigations
• Student investigations conducted by or authorized by the Dean of Student Services
• Title IX and other discrimination investigations
• Legal Discovery

Exceptions for Severance of Prohibited Technologies

The following exception allows business units, in coordination with the Information Security Officer, to perform data retrieval, account configuration(s), and other activities necessary to reduce the risk of cyber-attacks: 

Temporary maintenance of dormant, high-value data or accounts already in use on a prohibited technology

Technical Controls

A series of technical controls will be used to enforce the prohibition of technologies subject to this standard. Technical controls include, but may not be limited to, the following:

• All college-owned devices will be managed to detect and remove Prohibited Technologies and Covered Applications.
• All college-owned mobile devices will be enrolled in Mobile Device Management software.
• The college will block access to Prohibited Technologies and Covered Applications on all college-owned networks to prevent the download, installation, and/or communication of devices to prohibited technologies.

Administrative Controls

Measures that have been or will be taken include, but may not be limited to, the following: 

• Issuance of this standard; 
• As necessary and based on the level of risk presented to the college, removal of content on college webpages referencing and/or linking to Prohibited Technologies or Covered Applications other than those used to communicate and facilitate compliance with the orders, such as this standard; 
• Development of procurement procedures and review of institutional procurement activities to restrict the acquisition of Prohibited Technologies and Covered Applications; 
• Reviews of institutional research activity and grants regarding Prohibited Technologies and Covered Applications and development of procedures to avoid such activities without an authorized exception; 
• Development of procedures to identify and remediate Prohibited Technologies or Covered Applications controlled by the college and external parties on behalf of the college; 
• Communication to multiple stakeholder groups; 
• Establishment and reporting of exceptions authorized by the college president; 
• Identification and designation of Sensitive Locations; 
• Updates to college cybersecurity awareness programs to include information concerning Prohibited Technologies and Covered Applications; and 

Updates to applicable contracts and contract addenda to reflect the prohibitions of this standard and the TSUS Technologies Prohibited by Regulation Policy. 

Procedures for Personnel

The following general procedures should be followed by Personnel who are aware of the use of a Prohibited Technology, Covered Application, or Unauthorized Device to conduct College Business. 

1. Stop using the Prohibited Technology, Covered Application, or Unauthorized Device.
2. Report the use of Prohibited Technology, Covered Application, or Unauthorized Device using the college’s Information Security Incident Form if the technology is:
   1. Installed on or accessed from a college-owned device,
   2. Incorporated as part of a department’s or unit’s business or otherwise represents the college, or
   3. A component of the college’s infrastructure.
3. For personal devices used to conduct College Business:
   1. Remove the Prohibited Technology or Covered Application, or
   2. Cease using the personal device for College Business and remove all college data from the personal device.

Procedures for Specific Technologies Prohibited by Regulation

Procedures to Disable Social Media Accounts

To mitigate the likelihood of username reclamation and subsequent impersonation by threat actors, the following procedures are to be implemented by the respective information resource owner and information resource custodian of college-managed social media accounts: 

1. Archive copies of content posted to the account and store the archived copies in an authorized location (e.g., college file share or SharePoint) in compliance with the records retention schedule.
2. Remove all content from each account.
3. De-brand each account by removing all institutional logos, contact information, and similar details.
4. Set the account to private.
5. Leave the account active and maintain it under college control by storing the credentials in a secure manner.
6. Remove any remaining instances of the application from college-owned devices.
7. Confirm the account has been registered with Information Technology Services and do not use it further.

Additional procedures may include temporarily logging on to the account from an authorized source to prevent deactivation of the account and loss of the account’s reserved username after a period of inactivity as determined by the relevant social media service (e.g., 170 days for TikTok). These procedures may be activated based on several factors, including risk analysis, shifts in the threat landscape, and the status of authorized exceptions. 

Procedures for Exceptions to Technologies Prohibited by Regulation

The following procedures should be followed by personnel seeking an exception. 

1. Exceptions may be requested using the Information Security Policy Exception Form.
2. Exceptions must include a detailed business justification.
3. Additional information may be requested to determine if an exception is possible. 
4. Exceptions may only be approved by the college's president.
5. Approved exceptions will be reported to the Texas Department of Information Resources.
6. Approved exceptions may be subjected to review by the Office of the Governor, the Texas Legislature, or others appointed to review. 

If you have any questions regarding this Standard, please review the Technologies Prohibited by Regulation FAQ.