1. (a) Security incidents shall be promptly investigated and documented. Security incidents shall be reported to the department within twenty-four hours if there is a substantial likelihood that such incidents are critical in nature and could be propagated to other state systems beyond the control of the state agency.
2. (b) If criminal action is suspected, the state agency must contact the appropriate law enforcement and investigative authorities immediately.

3. (c) Each state agency shall provide summary reports to the department that contain information concerning violations of security policy of which the state agency has become aware. A state agency shall not be required to report security incidents unless it reasonably believes such incidents may involve criminal activity under Texas Penal Code Chapters 33 (Computer Crimes) or 33A (Telecommunications Crimes). Reports should include:

   1. (1) Type of activity, including but not limited to:

      1. (A) Unwanted disruption or denial of service;
      2. (B) Unauthorized use of a system for the processing or storage of data; and
      3. (C) Changes made to system hardware, firmware, data or software without the state agency's effective consent.
   2. (2) Time elapsed between initial detection of incident and containment of the security breach or full restoration of adversely affected functions, whichever is later;
   3. (3) Description of the state agency's response to the incident; and
   4. (4) Estimated total cost incurred by the state agency in containing the security incident or restoring adversely affected functions.
4. (d) Reports must be sent to the department on a monthly basis no later than nine (9) calendar days after the end of the month. Information shall be reported in the form and manner specified by the department.
5. (e) The department shall establish internal security procedures regarding the receipt and maintenance of information pertaining to security incidents. The department shall instruct state agencies as to the manner in which they must report such information.

Source Note:The provisions of this §202.26 adopted to be effective November 28, 2004, 29 TexReg 10703.