The Texas Cybersecurity Framework, a Must for Nonprofits

Are you a nonprofit organization that accepts funding from Texas?

If so, then the Texas Cybersecurity Framework (TCF) should be on your radar. As of 2019, all nonprofits must meet a set of 42 security control objectives defined by the State of Texas in order to maintain their state funding eligibility.

While this unprecedented law may seem daunting and complex to many organizations, it is really an opportunity for personal data security innovation and growth.

This blog post will provide an overview of TCF basics including definitions, coverage areas, processes required for compliance and more--so strap in for an informative journey into protecting your nonprofit's information!

What is the Texas Cybersecurity Framework (TCF)?

The Texas Cybersecurity Framework (TCF) is new legislation that provides guidelines for industry-validated best practices when it comes to cybersecurity. It contains 42 security control objectives, divided into five different functional areas, that nonprofit organizations must abide by in order to accept state funding.

Its primary focus is on protecting the confidentiality, integrity and availability of information, as well as providing safeguards against cyber threats. Even beyond these fundamental aspects, the TCF also looks to facilitate the development of a positively secure environment for any organization operating within Texas.

Ultimately, it helps organizations stay ahead of emerging technologies and safeguarding against constantly changing compliance regulations and postures in a cost-efficient manner.

How will it impact nonprofit organizations in Texas that accept state funding

Nonprofit organizations in Texas that accept state funding are now subject to the 42 security control objectives laid out in the new legislation, the Texas Cybersecurity Framework.

This could be seen as a positive move for the organizations, since it provides them with clear guidance on discrete issues within their security posture. Remaining compliant with state regulations will ensure that the organizations are not only protecting their own data and finances, but also recognize the importance of protecting the data of all citizens within Texas.

The regulations may require changes in existing processes or adoption of new forms of technology that help protect sensitive data and compliance simultaneously, giving nonprofits more control over how they operate safely and securely.

In a perfect world, once these controls are in place, yes a nonprofit gains more control over their data and security. However, for many nonprofits, the implementation of the 42 security control objectives could potentially be costly and time-consuming.

The 42 Security Control Objectives of the TCF and what they mean for nonprofits

The TCF's 42 control objectives are broken up into five broader categories: Identification, Protection, Detection, Response, and Recovery.

These objectives provide controls for data protection, authentication and privileged user access, security event monitoring and alerting, asset and configuration management, identity management, as well as other important aspects of cyber presence. By adhering to the TCF, nonprofits can increase their level of assurance around compliance with legislation while ensuring they are deploying the most rigorous security measures possible when dealing with sensitive data or materials.

You can see all 42 controls in this document created by the Texas Department of Information Resources.

It’s no surprise then that these new requirements are prompting serious conversations surrounding organizational policies and the implementation of modernized security protocols – taking cyber awareness among nonprofits to a whole new level.

Steps nonprofits can take to ensure compliance with the TCF

As a nonprofit in Texas, it's your responsibility to understand the Texas Cybersecurity Framework and take steps to ensure compliance. This can feel like a daunting task, as the framework contains many control objectives that spans several areas of operations.

Fortunately there are some key steps you can take to stay updated and maintain compliance. Make sure you keep up with new legislation in your area and have a plan in place for trainings, identifying assets that must be protected, implementing processes such as incident response, and staying informed on security vulnerabilities.

Taking the time upfront to plan properly can save organizations headaches, fines, and public embarrassment later on.

We recommend starting with the DIR's TCF Assessment that you can request here.

How can nonprofits find additional resources to help them comply with the TCF

You may be feeling overwhelmed with the new Texas Cybersecurity Framework, but don't despair! There are many resources available to help organizations comply with the TCF's 42 security control objectives.

Seeking out public records is one way to keep in touch with the latest information from state government. Attending workshops and webinars hosted by organizations that specialize in cybersecurity for nonprofits (hint hint - check out our Webinars On Demand) can also be helpful as these events provide detailed information about current issues and strategies for compliance.

Additionally, developing relationships with other nonprofits and technology providers who are knowledgeable about the TCF can help in understanding how best to secure your organization's data while staying true to its mission.

Benefits of implementing best practices when it comes to cybersecurity

Cybersecurity is a hot topic in today's world, and for good reason: the number of cyberattacks is only growing, leaving organizations more vulnerable than ever before.

The Texas Cybersecurity Framework presents nonprofits funded by the state with the opportunity to build stronger cybersecurity defenses by adopting best practices outlined in their 42 control objectives. Implementing these best practices allows nonprofits to not only protect data more effectively, but also keep up with their compliance requirements at the same time.

This not only saves valuable time and resources, but also saves them from unnecessary headaches down the road as they become better prepared to respond quickly to any potential cyber threats they may face.

Wrapping Up

With the TCF now in effect, it is important for nonprofit organizations in Texas to understand the 42 security objectives that are required for compliance and how to effectively implement them.

Taking the time to develop a cohesive cybersecurity strategy and implementing the right security controls can help protect these nonprofits from ransomware, other cyberattacks, data breaches, and more. However, we must also recognize that many of these organizations already have limited resources – and may find it difficult to figure out where to start when it comes to their risk management practices.

If you don't know where to begin, schedule a 15 minute discovery call with one of our cybersecurity experts. Whether you are looking for advice or support, we are here to help you navigate through all compliance requirements and provide guidance on best practices so your organization can stay secure. Schedule a call today and let's get started on protecting your organization's data!