To minimize the risk to university data, the university needs to take a methodical approach when engaging third party service providers and cloud-based services for data storage, processing or outsourcing of university data. The Vendor Risk Management program (abbreviated VRM) is UCF Infosec’s answer to this need.
The VRM process applies to any university department or university business unit considering contracting with a third party service provider for the purposes of storing, transmitting, processing, or collecting university data on our behalf.
In this process, the service-seeking unit submits information about the proposed vendor, solution, and data involved. The Information Security Office (ISO) reviews this package and follows up with the service-seeking unit and/or vendor regarding any questions or concerns. The Information Security Office review results in a formal VRM Assessment report which summarizes what was reviewed, any findings/concerns, and recommendations. The report is reviewed and signed by the appropriate UCF business and data owners, and a signed copy with their signatures must be returned to the Information Security Office.
UCF PROCESS DOCUMENTS
|Review 120 VRM Standard for specific guidance on Unrestricted, Restricted, or Highly Restricted VRMs and the process for each.|
|This is a list of all vendors that have been approved by ISO to meet 120 VRM Standards. To avoid duplication of vendors for similar use cases, UCF units should consult the Vendor Inventory list to ensure there isn't an existing solution for their use case that meets these standards and is already in use at UCF.|
UCF PROCESS DOCUMENTS
Review 120 VRM Standard for specific guidance on Unrestricted, Restricted, or Highly Restricted VRMs and the process for each.Vendor inventory list
This is a list of all vendors that have been approved by ISO to meet 120 VRM Standards. To avoid duplication of vendors for similar use cases, UCF units should consult the Vendor Inventory list to ensure there isn't an existing solution for their use case that meets these standards and is already in use at UCF.
|"Secure Handling of UCF Data” Agreement||Vendor reviews and accepts these terms and integrates them into the contract, agreement, or SLA associated with the engagement. This ensures that UCF’s security and compliance requirements are outlined in legal terms.|
|Vendor evaluates this questionnaire. The “Higher Education Cloud Vendor Assessment Tool” is an industry-standard questionnaire that assists in understanding a Vendor's security posture.|
|For vendors that may store, process, transmit or can impact the security of cardholder data, this addendeum clarifies the PCI responsibilities between the vendor and UCF.|
Vendor reviews and accepts these terms and integrates them into the contract, agreement, or SLA associated with the engagement. This ensures that UCF’s security and compliance requirements are outlined in legal terms.HECVAT
Vendor evaluates this questionnaire. The “Higher Education Cloud Vendor Assessment Tool” is an industry-standard questionnaire that assists in understanding a Vendor's security posture.PCI ADDENDUM
For vendors that may store, process, transmit or can impact the security of cardholder data, this addendeum clarifies the PCI responsibilities between the vendor and UCF.
Frequently asked questions
- Will the third party/vendor proposing this click-through agreement have access to, store, transmit, process, or collect any UCF data on our behalf?
- If yes, please go to Question 2.
- If no UCF data is involved at all, please proceed with the click through.
- Please refer to UCF Policy 4-008 and classify the data involved as Unrestricted, Restricted, or Highly Restricted Data.
- If the data involved is either Restricted or Highly Restricted, go to Number 3.
- if the data is Unrestricted, please go to Number 4.
- If Restricted data or Highly Restricted data is involved, do the following:
- A click through agreement alone is not acceptable. Engage the vendor to create a formal, mutually executed (signed by both parties) agreement that contains the Secure Handling of UCF Data agreement.
- Submit a Vendor Risk Management request to the Information Security Office for review via the ServiceNow link above.
- If Unrestricted data is involved…
- Review the agreement and verify that it has basic security language. Consult the FAQ item “What should be included in the final contract or agreement?” below for guidance on what should be present for Unrestricted Data.
- Proceed with the click through.
- Are you contracting with a third-party service provider for the purposes of storing, transmitting, processing, or collecting university data on your behalf?
- Are you transferring data currently residing on a computer system owned by the university to a computer system not owned by the university?
- Are you contracting with a service provider who will host a web site or system on behalf of the university to collect, process, or store university data?
- Are you contracting with a service provider to collect data that will later be transmitted for use by the university?
- Are you contracting with a service provider that will accept credit card payments on behalf of the university?
Consultants need a VRM review when:
- they host a website or system on behalf of UCF on the consultant’s infrastructure that will collect, store, process UCF Data.
- they implement a system for UCF on systems owned and managed by the consultant that will collect, store, process UCF Data.
Consultants do not need a VRM review when:
- a consultant may be exposed to a UCF Data as part of the work they do for the university.
- a consultant will be provided a sponsored account to access a system hosted by UCF (e.g. for patching or maintenance).
- a consultant implements a system for UCF on UCF-owned infrastructure (e.g., a UCF-owned server in a UCF datacenter or cloud).
For those consultants that do not require a VRM review, there are still contractual requirements for these consultants on how they must protect UCF data. To meet these requirements, simply submit the contract to UCF General Counsel via Cobblestone and ensure the Standard Consulting Services Agreement is included in the contract package.
If the data involved in your work on the software or hardware is not being stored, transmitted, processed, or accessed by the vendor you are purchasing from, it does not need to be submitted for VRM review.
However, if the piece of technology works in such a way that the vendor would store or process UCF data, it should be submitted for VRM review.
Regardless, ensure you are still following purchasing and procurement procedures for your unit and the university (such as Intent To Negotiate/ITN, Information Resource Request/IRR etc) where applicable.
Examples of items that do not require VRM review:
- Local software that is installed on a desktop machine where the data is stored on a UCF-owned workstation or server
- Software or platforms that will be installed in UCF-owned Infrastructure environments (e.g. Datasite orlando, Azure) and that will not transmit the data to any third parties
- computer hardware (servers, switches, monitors, desktops, laptops, etc) as long as they will be UCF owned and deployed within a UCF-owned envioronment (Datasite orlando, Azure)
Examples of items that do require VRM review:
The contractual language and agreements associated with a vendor or other third party are critical to managing risk to university data and an essential part of the VRM review process.
A formal and signed agreement between the UCF unit and the vendor or other third party is necessary and required before the service or software can be used and before any UCF data can be exposed to or accessed by the vendor. Per UCF Policy 4-014, “click-through” agreements, including, but not limited to EULAs, must be submitted to the UCF General Counsel’s Office for legal review, just like other agreements.
Per UCF Policy 4-014, any contract or business agreement with a vendor should incorporate a number of items in order to reduce the risk to UCF. To this end, for engagements involving restricted and highly restricted data:
- The “Secure Handling of UCF” Agreement must be signed by the vendor and included in the final set of agreements.
- Any edits or redlines to the “Secure Handling of UCF Data” Agreement, or any data or security-related edits to the contract in general, must be jointly reviewed by UCF Infosec and the UCF General Counsel’s Office prior to acceptance and execution.
- NO contract shall be executed until an acceptable agreement has been negotiated between UCF and the other party/vendor, reviewed and approved by the UCF General Counsel’s Office, and a VRM assessment report is provided to the UCF unit and signed by UCF unit leadership.
- In cases where there is no formal agreement (such as only having a PO), the “Secure Handling of UCF” Agreement must be executed and attached.
|Data Type||Required Documents for ISO Review||May be needed upon ISO request:|
|– including PCI||
|– including HIPAA||
|Unrestricted||No submission needed. See 120 VRM Standard.|
The data involved determines what should be included in the final contract or agreement:
|Data Involved||Include with contract:|
|Highly Restricted Data||Secure Handling of UCF Data Agreement|
|Restricted Data||Secure Handling of UCF Data Agreement|
Should contain sections relating to:
It is important to re-review a vendor whenever key parts of the engagement have changed. This can include:
- Any time the contract or agreement is changed or is up for renewal
- Any time the data that will be shared with the vendor changes (especially if the newly proposed data is classified at a higher level of restriction)
- See UCF Policy 4-008 at http://policies.ucf.edu/ for information on the classification of UCF Data
- Any time the means of data transfer changes, such as adding a connection to an on-premise UCF system
- Any time the vendor experiences a data- or security-related breach
ISO requires the VRM assessment report to be signed and returned by the UCF service-seeking unit. The signatures represent an acknowledgement of the findings and recommendations. The signatures do not have to wait on the actual completion of any recommendations. Additionally, there may be up to two signature fields – the UCF Business Unit and the UCF Data Owner.
UCF Business Unit – The service-seeking unit engaging directly with the vendor. This signature is always required.
UCF Data Owner – This is the person primarily responsible for the accuracy, privacy, and integrity of the data that is proposed to be shared with the vendor under review. When the owner of the data differs from the service-seeking unit, ISO may require their signature acknowledging the potential risks and recommendations.
For example, if FERPA-protected data is involved, UCF’s Registrar’s Office may need to sign as data owner.
In both cases, the signees should be at a leadership/VP level empowered to accept risk on behalf of the unit.