Prohibited Technology FAQs

Covered applications are limited to certain social media applications and services, such as TikTok. The prohibition against covered applications extends only to institution-owned devices, and exceptions are extremely limited to law enforcement and information security purposes.

Prohibited technologies are a broad set of hardware and software products and services specified by the Texas Department of Information Resources (DIR). The prohibition has a broad set of technical and administrative requirements that apply to both institution-owned devices and personally-owned devices used for state business.

Faculty and staff may request exceptions for Prohibited Technologies. To request an exception, submit a General IT Service Request in the Service Portal. Please provide:

• The part of the regulation that you are requesting an exception from.
• Why the exception is needed (business justification).
• What compensating controls you will use.

The request must be initiated by the college dean or department head. Exceptions may only be approved by the university president.

Approved exceptions will be treated as high residual risk decisions and reported to the Texas Department of Information Resources (DIR).

No exceptions may be authorized for social media services classified as Covered Applications under Texas Government Code Chapter 620.

DIR maintains a list of Prohibited Technologies, including software, applications, developers, hardware, equipment, and manufacturers, as well as technologies from any subsidiary or affiliate of an entity on DIR’s list (e.g., a software studio or child company partially owned by a listed entity).

The Texas A&M System does not manage user personal devices. Users with personal devices with prohibited technologies installed will be prohibited from entering sensitive locations and may be blocked on A&M System member networks if they connect to those networks.

The Texas A&M System and its members are public institutions of higher education and state agencies, and are therefore subject to complying with requirements set by the Office of the Governor, rules set by regulatory agencies, and legislative mandates passed into law. Further, the A&M System issues policies corresponding to similar compliance requirements.

TAMU-CC Information Technology offers USB Security Keys as an alternative to using your smartphone for Duo authentication. These may be obtained through a request to the TAMU-CC IT Service Desk without cost to you or your department.

These rules apply to all individuals accessing institution-owned information resources.

You may have prohibited technologies on personally-owned devices. However, you cannot conduct state business from a personally-owned device that contains prohibited technologies.

Refer to your university's acceptable use policies [PDF] for further information.

Contact your university's information security office for guidance.

Contact your university's information security office for guidance.

This answer depends on the tools and technologies you use on a day-to-day basis. Employees who use only institution-owned devices, software, and other technologies to do their job should experience little to no impact.

Discontinue the use of the prohibited technology and contact your institution's information security office for guidance.

No. Having prohibited technology on your personal device while conducting state business is prohibited. You need to remove the prohibited technology before continuing to use this device for state business. If you are required to conduct state business on this device and cannot or will not remove the prohibited technology, you should consult with your supervisor about what device(s) may be made available for performing your duties.

Yes, within the scope of this prohibition, using your personal device as part of Duo/Microsoft/etc. Multi-Factor Authentication (MFA) is not considered conducting state business.

It is recommended that an institution-issued device be used to work remotely. However, if a personal device is being used to conduct state business, prohibited technologies cannot be installed.

No. Requirements set forth by objective four of the governor’s order for network restrictions are limited to institution-owned networks.

Yes, you are allowed to use your personal device to call or text your coworkers to conduct state business if you are not transmitting sensitive or confidential information.

DIR maintains a list of Prohibited Technologies, including software, applications, developers, hardware, equipment, and manufacturers, as well as technologies from any subsidiary or affiliate of an entity on DIR’s list (e.g., a software studio or child company partially owned by a listed entity).

No. Device management only applies to institution-owned devices.