This control standard replaces the Blocked Countries standard that was implemented in May 2025.
In order to implement the requirements of the Texas Statewide Plan for Preventing Use of Prohibited Technology in State Agencies, the Texas A&M System has implemented a baseline minimum of blocked outbound domains.
DIR has added seven new security control standards in version 2.2 of their security control standards catalog. These have been incorporated into the A&M System Security Control Standards Catalog, published at https://www.cyber.tamus.edu/catalog/. All controls have a required implementation date of February 28, 2027, and are listed below:
The Texas A&M System Security Control Standards Catalog was updated today to incorporate NIST SP 800-53 Release 5.2.0. The update also included a cosmetic change to the catalog generation code to zero-pad control and enhancement numbers, consistent with NIST SP 800-53.
We released today a series of administrative changes to the security control standards. The majority of these changes moved TAMUS Implementation Statement language into organizationally-defined parameters (ODP) within each control, as well as implementing control standards that reflect existing system policy and assigning an impact baseline for all TAMUS-required controls.
The comment period for new security control standards regarding Identity Proofing (IA-12(02)) and Identity Evidence Validation and Verification (IA-12(03)) has closed and the new standards have been published in the A&M System Security Control Standards Catalog.
Because this is a time-sensitive procedural implementation to address actively-exploited cyber risks, the implementation date is effective September 1.
When developing your member-level procedures to implement this control standard, please also take into consideration distributed systems with user accounts for which organizations other than IT may be responsible (this includes HR for TAMUS SSO accounts, Provost/Enrollment Management/Alumni Affairs for prospective students, alumni, etc.) and ensure those administrators are properly briefed on the control requirement.