Before a vendor or third party can access, create, or maintain university data, UT System Administration policy UTS 165 requires a security risk assessment of the vendor’s products and/or services. In addition, Texas Government Code 2054.003 (13) requires Texas state agencies to only enter or renew contracts with cloud service providers that comply TX-RAMP’s security requirements. The TX-Ramp requirement ensures that cloud services, storing, processing, or managing university data are secure and compliant with state mandates.
UT System’s vendor risk assessment ascertains the following:
- that the vendor has sufficient technological, administrative, and physical safeguards to ensure the confidentiality, security, and integrity of the data at rest and during any transmission or transfer; and
- that any subcontractor or other third-party that will access, maintain, or create data pursuant to the contract will also ensure the confidentiality, security, and Integrity of such data while it is at rest and during any transmission or transfer.
Request a Vendor Risk Assessment (ISOTRAQ)
FAQs
What do we assess?
The Information Security Office performs security risk assessments for software used by UT System Administration and selected system-wide initiatives. We also assess service providers, including UT System contractors (either individual or organization).If a UT System Administration account is provisioned, Security Awareness training is required per HB 3834. This training can be accessed here.
Why is it necessary to assess vendors and other third-parties?
We assess software and service providers in order to comply with UT System policy (UTS 165) and State policy (Texas Administrative Code 477). Insufficient or non-existent vendor security controls increase the risk of unauthorized system access and data exposure.
When should I request a vendor risk assessment?
Assessments should be requested before the decision is made to procure new software or services; or when you are renewing a contract/agreement for existing software or services that will access, process, store or create confidential or controlled university data. A new assessment is required if there are significant changes to the software or services being provided. For example: a previous installation of software was on premises, but the new contract is for cloud-based software. In addition, a new assessment will be needed for software and services that access, transmit, or create confidential data or is considered critical infrastructure and the previous assessment is more than one year old.
When is an assessment not required?
An assessment is not required if the software or service was:
- assessed by the ISO within the last 12 months;
- does not access, store, or process, confidential or controlled data:
- is not considered critical infrastructure,
- only used to access, process, store or create published data or consumption-focused services, or
- all recommendations from the previous assessment have been implemented (if applicable).
What about hardware, does it need to be assessed?
An assessment for a hardware purchase is only required if the hardware is related to securing university resources or contains a software component that allows login or authentication capability. For example: a firewall or an intrusion protection system.
What about Artificial Intelligence (AI) tools?
Any use of AI features should be disclosed while completing the intake form for the vendor risk assessment. AI poses various risks, such as data leakage, present wrong or incorrect statements as facts, and may use university data to train its model, which is not allowed by state law. AI should not be used with confidential or controlled data unless an exception is approved.
Should I provide any documentation for the assessment?
Documentation such as a vendor's information security policy, certifications (ISO 27001, SOC 2 Type 2, Cloud Security Alliance Questionnaire, etc.) or implementation guides are recommended and allow us to better understand the intended use of the product/service you would like to purchase as well as the third-party vendor. For requests that will use confidential data or serve a critical infrastructure role for UT System Administration, a HECVAT (Higher Education Community Vendor Toolkit) is required. The HECVAT allows us to reduce risk by ensuring that third-party vendors have the appropriate information security and privacy policies in place to protect our data. Please contact your vendor representative to obtain their HECVAT, or if they have not completed one already, a blank one can be downloaded from EDUCAUSE's website https://www.educause.edu/higher-education-community-vendor-assessment-toolkit.
What is considered "Critical Infrastructure"?
This refers to our physical and virtual assets, systems, and networks that are essential for UT System Administration operations. Examples include, but are not limited to, routers, firewalls, switches or virtual private networks (VPN).
How long does a risk assessment take?
We strive to complete requests within ten business days. However, the ISO may request a meeting with the Departmental business owner and/or vendor to understand the scope of the product or service more completely, which may affect completion time. In addition, services that will process, store, or handle UT System Administration Confidential data will require a more in-depth assessment, additional documentation from the vendor, and/or a longer review time. We ask that business staff enter a request into ISOTRAQ as early in the process as possible.
What can cause a delay in the assessment process?
Common factors include:
- request volume fluctuations because of budget and calendar cycles,
- Non-disclosure agreements, Business Associate Agreements, or other vendor-related requirements, or
- Vendor response turnaround time.
How can I mitigate any possible delays?
We recommend that you work with your department’s DCA to gather as much information as possible and plan to facilitate engagement between the ISO and the vendor when more information/documentation is required.
Is there an expedited process?
We do not have an expedite process. If your request is facing extenuating circumstances, your request is time sensitive, or requires expedited review, please notify the ISO as soon as possible and we'll work one-on-one with your department to ensure your request is processed.
Does Information Security approve or deny projects?
The ISO does not approve or deny the use of software or vendors. Barring any requirements from ISO, legal affairs, Privacy Office, or IT, the business owner typically (aka Data Owner) has the final decision on whether to proceed with proposed software or not. However, a Security Exception Request form may be required.
What if risks are identified?
Recommendations to remediate any deficiencies identified during the process will be communicated in the results of the completed assessment.
What if an assessment has already been performed for the software I want to use?
If you would like to use software that is already being used by another department, we still require a separate request to be submitted. While the software may be the same, the intended use case, enabled features or modules, and the type of data being processed can differ between departments. For example, one department may handle Confidential data, while another may only process Controlled data. Submitting a new request also allows us to assess the different use cases appropriately and helps maintain visibility into software usage across multiple departments in our organization.
What happens after the assessment?
You will receive an email from our ISOTRAQ application, where you can review the results, and any recommendations or requirements neededbefore continuing in your procurement process.
What happens if the vendor cannot supply appropriate security controls documentation?
If the ISO cannot complete a vendor assessment because the vendor is unable to provide applicable security controls information, the CISO, Privacy Officer, OTIS, and the Business Owner will need to discuss the feasibility of the software or service within the UT System Administration environment.
