Statewide Portal for Enterprise Cybersecurity Threat, Risk, and Incident Management
To help tie together the overall state security program, DIR has implemented a governance, risk, and compliance software tool available to all state agencies and institutions of higher education. The SPECTRIM portal provides tools for managing and reporting security incidents, conducting risk assessments, storing and managing organizational policies, performing assessment and authorization (A&A) on information systems, templates for agency security planning activities, and more.
The SPECTRIM portal is free for all Texas state agencies, public institutions of higher education, and public community colleges. There is no limit to the number of users each organization can have. Local government entities and K-12 organizations are eligible for the SPECTRIM for Locals offering through DIR's managed security services program on a 12-month subscription basis. The SPECTRIM for Locals offering is a replica instance of the statewide SPECTRIM instance. For additional information contact GRC@dir.texas.gov.
Urgent Incident Reporting
TAC §202 requires each state agency and institution of higher education to provide
timely reporting of certain types of security incidents to DIR which, depending on the threat or level of risk to the State, could mean emergency reporting. Timely reporting is required (preferably within 24 hours) for incidents that may:
- Propagate to other state systems (emergency reporting) OR
- Result in criminal violations that shall be reported to law enforcement OR
- Involve the unauthorized disclosure or modification of confidential information, e.g., sensitive personal information.
NOTE: If you cannot log into your SPECTRIM account to log a security incident, you can contact DIR's Cybersecurity Incident Response and Assistance hotline at (877) DIR-CISO (877-347-2476). The phone is answered 24 hours a day, 7 days a week.
Additionally, the DIR Network Security Operations Center (NSOC) may be able to provide assistance regarding security incidents.
To report a suspected phishing attempt, send the email as an attachment to firstname.lastname@example.org. Our NSOC Analysts will review the message and block any identified malicious requests at the perimeter, these contributions go a long way to improving the security of our community as a whole.
The SPECTRIM Incident Management Manual provides you with step by step instructions for using the Incident Management module.
HB 4390 (86R) amended Texas Business and Commerce Code Section 521.053 to require applicable entities to report a breach of sensitive information to the attorney general in cases where 250 or more Texas residents' data were subject to unauthorized disclosure. Such incidents should be reported through the Office of the Attorney General's website starting January 2020.
Monthly Incident Reporting System
TAC RULE §202.23(b)(2) and §202.73(b)(2) requires agencies and institutions of higher education to submit a report of security-related events to the department on a monthly basis no later than nine (9) calendars days after the end of the month. These reports are submitted through the SPECTRIM Portal's Monthly Incident Reporting System. Members of the incident access group with active SPECTRIM accounts will be reminded via system generated notifications prior to the reporting deadline. For more information concerning the monthly incident reporting system, please see slides 46-50 of the SPECTRIM Incident Management Manual above or contact GRC@dir.texas.gov.
The policy management solution allows organizations to store, manage, and review their IT and security policies as well as link policy components to applicable security controls. View the SPECTRIM Policy and Security Plan Template Training Slides.
Agencies and institutions of higher education now have the option of participating in the Texas Policy Sharing Group within the portal. This group allows users to elect to share their policies across organizations with other participating members. For more information on sharing policies see the
Texas Policy Sharing Group Overview.
TAC §202 requires that a risk assessment of the organizations' information and information systems shall be performed and documented. To help facilitate this requirement, the portal offers a risk assessment tool with standard questionnaires for application, facilities, organizational, and network assessments.
- The inherent impact will be ranked, at a minimum, as either "High," "Moderate," or "Low".
- The frequency of the future risk assessments will be documented.
- Risk assessment results, vulnerability reports, and similar information shall be documented and presented to the Information Security Officer or his or her designated representative(s).
- Approval of the security risk acceptance, transference, or mitigation decision shall be the responsibility of:
- the information security officer or his or her designee(s), in coordination with the information owner, for systems identified with a Low or Moderate residual risk.
- the state agency head for all systems identified with a residual High Risk.
The SPECTRIM Risk Manual provides you with step by step instructions for using the Risk Assessment module.
The portal additionally supports a top-down risk assessment approach through the risk register. The risk register helps organizations track and manage critical risks and risk treatments over their lifecycle.
Agency Security Plan Template
The Agency Security Plan template gives agencies:
- A method for reporting on the types of controls they have in place
- An evaluation of their ability to operate the control environment at their required level
- A standardized approach for preparing the agency’s ongoing security plan
Visit the agency security plan web page for more information and resources to complete your plan.
Assessment & Authorization (A&A)
DIR has implemented a solution within the portal for performing information system assessments and authorization based on the
NIST Risk Management Framework. Due to the complexity of this solution, we are asking that interested parties contact GRC@dir.texas.gov to schedule an overview and training session.