TAC 202 compliance means every Texas state agency and public institution of higher education must build a documented information security program approved by its agency head or president, adopt the Department of Information Resources (DIR) Security Control Standards Catalog, run documented risk assessments, designate a qualified Information Security Officer, use only TX-RAMP certified cloud vendors, report serious incidents to DIR within 48 hours, and submit a Biennial Information Security Plan through the SPECTRIM portal by June 1 of each even-numbered year.
Each of those obligations has specific contents and sign-offs attached. Missing any of them is a compliance gap, not a minor housekeeping issue, because DIR verifies them on a two-year cycle and the agency head signs an acknowledgment of risk when the plan goes in.
Who Has to Comply
TAC 202 covers two groups on parallel tracks. Subchapter B applies to state agencies: departments, boards, commissions, and offices created by the legislature. Subchapter C applies to institutions of higher education, including public universities and health-related institutions.1Legal Information Institute. Texas Administrative Code Title 1 Part 10 Chapter 202 – Information Security Standards The core obligations are the same; the section numbers differ.
DIR sets the floor, publishes the controls catalog, and collects the biennial plans. Implementation is on you. The agency head or institution president owns the risk, and you can go stricter than DIR requires but cannot pick and choose which parts of the catalog to follow.2Texas Department of Information Resources. Texas Administrative Code Chapter 202
Adopt the Security Control Standards Catalog
DIR’s Security Control Standards Catalog is built on NIST SP 800-53, Revision 5, the same framework the federal government uses.2Texas Department of Information Resources. Texas Administrative Code Chapter 202 Every control in the catalog is mandatory regardless of the NIST baseline level associated with it.3Texas Department of Information Resources. Security Control Standards Catalog
The controls are not purely technical. They cover personnel screening, training, and physical access alongside the system-level requirements. If your agency head wants to adopt stricter standards, that is allowed, but any custom standard has to incorporate everything in the catalog and align with applicable federal law, state policy, and industry best practices.3Texas Department of Information Resources. Security Control Standards Catalog
Build and Document the Information Security Program
Section 202.24 (state agencies) and § 202.74 (higher education) require a formal, agency-wide information security program approved by the head of the entity. It must cover all information and information resources the entity owns, leases, or has custody of, including anything outsourced to contractors or hosted in the cloud.4Legal Information Institute. Texas Administrative Code 202.24 – Agency Information Security Program
The program has to include:
- Periodic risk assessments covering unauthorized access, disclosure, disruption, modification, and destruction of information and systems.
- Policies, standards, and procedures based on those assessments that bring risk down to a level the agency head finds acceptable, while complying with the DIR controls catalog.
- Specific strategies for protecting the entity’s most sensitive or critical information resources.
- Security addressed throughout the full lifecycle of every information resource, from procurement through decommissioning.
- A documented remediation process for identified deficiencies.
- A formal process for justifying, granting, and documenting exceptions.
A program that exists only on paper fails. The code requires implementation, and the biennial reporting cycle is how DIR checks.4Legal Information Institute. Texas Administrative Code 202.24 – Agency Information Security Program
Name the Right People and Define Their Duties
TAC 202 assigns accountability to specific, non-delegable roles. This is where most compliance failures start.
Agency Head or Institution President
Under § 202.20, the head of the entity must review and approve the information security program at least annually and integrate security management into strategic and operational planning.5Legal Information Institute. Texas Administrative Code 202.20 – Responsibilities of the Agency Head When the biennial security plan goes to DIR, Texas Government Code § 2054.133 requires the agency head, chief financial officer, and each designated executive manager to sign a document confirming they have been made aware of the risks identified during plan preparation.6Texas Public Law. Texas Government Code Section 2054.133 – Information Security Plan That signature exists so executives cannot later claim they did not know.
Information Security Officer
Every state agency must designate an Information Security Officer under Texas Government Code § 2054.136. The ISO has to report to executive-level management, hold authority over information security for the entire agency, carry the training and experience the role requires, and to the extent feasible, treat information security as their primary duty.7Texas Public Law. Texas Government Code Section 2054.136 – Designated Information Security Officer The reporting line to executive management is not optional. It exists so security concerns reach decision-makers without being filtered by middle management.
Under § 202.21, the ISO must report at least annually to the agency head on the status and effectiveness of the security program and its controls.8Legal Information Institute. Texas Administrative Code 202.21 – Responsibilities of the Information Security Officer That annual report is separate from the biennial plan sent to DIR.
Information Owners and Custodians
Section 202.22 defines two roles that sit closer to the data. Information owners classify data according to the entity’s categories, approve access and periodically review access lists, coordinate security requirements with the ISO, perform risk assessments, and remain accountable for any exceptions granted for their data.9Legal Information Institute. Texas Administrative Code 202.22 – Staff Responsibilities
Information custodians, including third-party contractors handling outsourced services, implement the controls the owner specifies, follow ISO-approved monitoring procedures, report incidents, and ensure information is recoverable consistent with the entity’s risk decisions.9Legal Information Institute. Texas Administrative Code 202.22 – Staff Responsibilities Owner decides what protection is needed; custodian makes it happen.
Run Documented Risk Assessments
Section 202.25 (state agencies) and § 202.75 (higher education) require each entity to perform and document a risk assessment of its information, systems, and applications. Risks and their impacts must be ranked at a minimum as High, Moderate, or Low.10Legal Information Institute. Texas Administrative Code 202.25 – Managing Security Risks11Legal Information Institute. Texas Administrative Code 202.75 – Managing Security Risks
Results, vulnerability reports, and related documentation go to the ISO or their designee. The schedule for future assessments must also be documented, so there is an auditable commitment to regularity. For systems rated high residual risk, the decision to accept, transfer, or mitigate must be approved personally by the agency head or institution president. Lower-risk decisions can be handled by the ISO in coordination with the information owner.11Legal Information Institute. Texas Administrative Code 202.75 – Managing Security Risks
The program’s policies and controls under § 202.24 must be based on these assessments. Skip the assessment and every control choice downstream is unsupported.4Legal Information Institute. Texas Administrative Code 202.24 – Agency Information Security Program
Use Only TX-RAMP Certified Cloud Vendors
Section 202.27 requires that any state agency contracting for cloud services that store, process, or transmit the agency’s data confirm the vendor holds TX-RAMP certification before entering or renewing the contract. The vendor must maintain that certification for the entire contract term.12Legal Information Institute. Texas Administrative Code 202.27 – Texas Risk and Authorization Management Program
TX-RAMP is DIR’s own certification process. Including security language in a contract does not substitute for it. Signing with a non-certified cloud vendor is a compliance violation regardless of how strong the vendor’s actual security is, which makes this a procurement-team issue as much as a security-team issue.
Report Incidents on the 48-Hour Clock
Each entity has to assess the significance of security incidents based on business impact and technical effect, weighing factors like lost revenue, lost productivity, service disruption, reputation damage, unauthorized disclosure of confidential information, or potential spread to other networks. Confirmed or suspected incidents must be reported to immediate supervisors and the entity’s ISO.13Legal Information Institute. Texas Administrative Code 202.73 – Security Reporting
Some incidents trigger a 48-hour reporting deadline to DIR: those assessed as likely to spread to other state systems or likely to result in criminal violations. The report must be submitted in the form and manner DIR specifies. Missing that 48-hour window is one of the fastest routes to intensified DIR scrutiny, especially if the incident later turns out to be worse than first assessed.13Legal Information Institute. Texas Administrative Code 202.73 – Security Reporting
Separately, Texas Business and Commerce Code § 521.053 imposes a 60-day deadline for notifying individuals affected by a breach involving personal identifying information. That runs alongside the TAC 202 obligations and does not replace them.
Submit the Biennial Plan and Assessment Through SPECTRIM
By June 1 of each even-numbered year, every state agency and institution of higher education must submit a Biennial Information Security Plan to DIR through the SPECTRIM portal.14Texas Department of Information Resources. Information Security Plan Texas Government Code § 2054.133 sets the contents: vulnerability assessments, identification of staff responsibilities, risk management measures, and incorporation of DIR’s best practices (or a written explanation of why those practices are insufficient for your agency).6Texas Public Law. Texas Government Code Section 2054.133 – Information Security Plan
Alongside the plan, each entity must complete a biennial information security assessment under § 202.23 (state agencies) or § 202.73 (higher education) covering information resource systems, network systems, digital data storage, and vulnerabilities. A data maturity assessment aligned with 1 TAC § 218.10 is also required. Results go to DIR and must be provided on request to the Governor, Lieutenant Governor, or Speaker of the House.15Legal Information Institute. Texas Administrative Code 202.23 – Security Reporting
Submitted plans are confidential and exempt from public disclosure under Chapter 552 of the Government Code. A published plan would be a map for attackers. Entities should also leave out of any written copies of the plan any information that could expose vulnerabilities in their networks or systems.6Texas Public Law. Texas Government Code Section 2054.133 – Information Security Plan
Watch for Federal Requirements on Top of TAC 202
TAC 202 compliance alone may not be enough if your agency handles federal data. Entities receiving federal tax information must also comply with IRS Publication 1075, which imposes its own data center controls, access restrictions, and safeguard requirements on top of the state baseline. Illegal disclosure of federal tax information carries criminal penalties.
The NIST SP 800-53 foundation under DIR’s catalog gives Texas agencies a structural head start on federal cybersecurity requirements, but federal standards often add controls or stricter implementation. If you handle federal data from programs like Medicaid, Social Security, or child support enforcement, verify your obligations under the specific federal program rather than assuming TAC 202 covers them.