1. Will the third party/vendor proposing this click-through agreement have access to, store, transmit, process, or collect any UCF data on our behalf?
   
   1. If yes, please go to Question 2.
   2. If no UCF data is involved at all, please proceed with the click through.
2.  Please refer to UCF Policy 4-008 and classify the data involved as Unrestricted, Restricted, or Highly Restricted Data.
   
   1. If the data involved is either Restricted or Highly Restricted, go to Number 3.
   2. if the data is Unrestricted, please go to Number 4.
3.  If Restricted data or Highly Restricted data is involved, do the following:
   • A click through agreement alone is not acceptable. Engage the vendor to create a formal, mutually executed (signed by both parties) agreement that contains the Secure Handling of UCF Data Questionnaire.
   • Submit a Vendor Risk Management request to the Information Security Office for review via the ServiceNow link above.
4.  If Unrestricted data is involved…
   • Review the agreement and verify that it has basic security language. Consult the FAQ item “What should be included in the final contract or agreement?” below for guidance on what should be present for Unrestricted Data.
   • Proceed with the click through.

If you answer YES to any of the following questions, your project needs a VRM review.

• Are you transferring data currently residing on a computer system owned by the University of Central Florida to a computer system not owned by the University of Central Florida?
• Are you contracting with a service provider who will create a web site or implement a system on behalf of the University of Central Florida to collect, process, or store university data?
• Are you contracting with a service provider to collect data that will later be transmitted for use by the University of Central Florida?
• Are you contracting with a service provider that will accept credit card payments on behalf of the University of Central Florida?

If you have any questions about the applicability of the Vendor Risk Management process, please do not hesitate to contact the Information Security Office.

1. The Secure Handling of UCF Data Questionnaire must be signed by the vendor and included in the final set of agreements.
2. Any comments, edits or redlines to the Secure Handling of UCF Data Questionnaire, or any data or security-related edits to the contract in general, must be jointly reviewed by UCF Infosec and the UCF General Counsel’s Office prior to acceptance and execution.
3. NO contract shall be executed until an acceptable agreement has been negotiated between UCF and the other party/vendor, reviewed, and approved by the UCF General Counsel’s Office, and a VRM assessment report is provided to the UCF unit and signed by UCF unit leadership in the case of highly restricted data.
4. In cases where there is no formal agreement (such as only having a PO), the Secure Handling of UCF Questionnaire must be executed and attached.

The length of the VRM process depends on a number of factors, including what data is involved, the vendor’s responses and follow-up, and contractual language needed. Typically, when highly restricted or restricted data is involved in the proposed engagement, a period of several weeks is needed but can be longer.

Note that a key part of the VRM process is ensuring that contracts and agreements contain agreeable language from a data security and compliance point of view. If the vendor disagrees with terms of the Secure Handling of UCF Data Questionnaire, the interactions with a vendor’s legal team and the general process of modifying contracts and agreements in tandem with UCF General Counsel may add significant time to the process before a VRM Assessment Report can be provided.

ISO needs to perform our due care and diligence to minimize the risk to UCF data shared with vendors. Please submit a VRM request as early as possible in the procurement process to ensure ISO has enough time to review the vendor.

If the data involved in your work on the software or hardware is not being stored, transmitted, processed, or accessed by the vendor you are purchasing from, it does not need to be submitted for VRM review.

However, if the piece of technology works in such a way that the vendor would store or process UCF data, it should be submitted for VRM review.

Regardless, ensure you are still following purchasing and procurement procedures for your unit and the university (such as Intent To Negotiate/ITN, Information Resource Request/IRR etc) where applicable.

Examples of items that do not require VRM review:

• Local software that is installed on a desktop machine where the data is stored on a UCF-owned workstation or server
• Software or platforms that will be installed in UCF-owned Infrastructure environments (e.g. Datasite orlando, Azure) and that will not transmit the data to any third parties
• computer hardware (servers, switches, monitors, desktops, laptops, etc) as long as they will be UCF owned and deployed within a UCF-owned envioronment (Datasite orlando, Azure)

Examples of items that do require VRM review:

• a file transfer tool that sends data through a third party server before reaching the destination file storage software that connects to a third party cloud storage service

The data involved determines what should be included in the final contract or agreement:

It is important to re-review a vendor whenever key parts of the engagement have changed. This can include:

• Any time the contract or agreement is changed or is up for renewal
• Any time the data that will be shared with the vendor changes (especially if the newly proposed data is classified at a higher level of restriction)
  • See UCF Policy 4-008 at http://policies.ucf.edu/ for information on the classification of UCF Data
• Any time the means of data transfer changes, such as adding a connection to an on-premise UCF system
• Any time the vendor experiences a data- or security-related breach

ISO requires the VRM assessment report to be signed and returned by the UCF service-seeking unit. The signatures represent an acknowledgement of the findings and recommendations. The signatures do not have to wait on the actual completion of any recommendations. Additionally, there may be up to two signature fields – the UCF Business Unit and the UCF Data Owner.

UCF Business Unit – The service-seeking unit engaging directly with the vendor. This signature is always required.

UCF Data Owner – This is the person primarily responsible for the accuracy, privacy, and integrity of the data that is proposed to be shared with the vendor under review. When the owner of the data differs from the service-seeking unit, ISO may require their signature acknowledging the potential risks and recommendations.

For example, if FERPA-protected data is involved, UCF’s Registrar’s Office may need to sign as data owner.

In both cases, the signees should be at a leadership/VP level empowered to accept risk on behalf of the unit.