Third Party Vendor Management

Purpose

The Third-Party Vendor Security Management program, governed by the Information Security Team, is an initiative to reduce the risk to University Data and computing resources from Third-Party Providers. Information Security collaborates with the Office of Legal Affairs, the Office of Procurement & Business Affairs, the University Data Protection Officer (DPO), and University Departments to protect Information Technology Resources and digital intellectual property at the University.

The purpose of this policy is to ensure that all vendors have appropriate controls to minimize risks that could adversely impact Confidentiality, Availability, and/or Integrity of the service or product.

1. This Policy applies to all University operations involving University Information or its Information Technology Resources.
2. This Policy applies to all University Employees as well as adjunct faculty, Third-Party Providers to include contractors, consultants, temporary employees, and other third parties performing duties on behalf of the University.

Definitions

Defined terms are capitalized throughout this Policy and can be found in the Information Governance Glossary.

1. Initial Screening
   1. All University departments engaging third-party IT products or services are required to undergo a security risk review of the requested product or service.
   2. Based on the security review performed, the UMGC Information Security Team will determine if a comprehensive security assessment will be required prior to entering into any agreement with the vendor.
2. Comprehensive Security Assessment
   1. The Third-Party Provider must complete a security questionnaire, known as the Higher Education Community Vendor Assessment Toolkit (HECVAT) and/or provide a copy of their most recent independent security audit or certification reports (i.e., SOC 2, ISO 2700x certification).
   2. The Information Security Team will review the security assessment and determine whether the Third-Party Provider complies with the University security requirements. If the Third-Party Provider is non-compliant, compensating controls will need to be implemented and reassessed.
3. Contracting Agreements
   1. Third-Party Providers that will store, process, or transmit Data must:
      1. Sign a Data Processing Agreement (DPA) if applicable.
      2. Permit inclusion of UMGC standard security clauses and language in all relevant contracts, which addresses compliance with UMGC security policies, right to audit, right to access, right to monitor, and compliance with applicable regulations where feasible.
4. Subsequent Reviews
   1. Security reviews for third-party providers will cover a single use case and are required upon a new solution acquisition, changes in scope or use cases for current solutions, changes in system design or controls, business transfer, merger, or acquisition, and upon the renewal of current solutions.
   2. Periodic review of a Third-Party Provider security posture and continued compliance will be conducted as needed, based upon changes in system use, design or controls, contract renewal or business transfer, merger, or acquisition.

Exceptions

Exceptions to this policy should be submitted to Information Security for review and approval. If an exception is requested a compensating control or safeguard should be documented and approved.

1. Any Employee, Contractor, or Third-Party Provider performing duties on behalf of the University with knowledge of an alleged violation of this Policy shall notify Information Security as soon as practicable.
2. Any Employee, Contractor, or other Third-Party Provider performing duties on behalf of the University who violates this Policy may be denied access to Information Resources and may be subject to disciplinary action, up to and including termination of employment or contract or pursuit of legal action.

1. USM IT Security Standards, v.5, dated July 2022
2. NIST SP 800-171r2 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” dated February 2020.
3. Cybersecurity Maturity Model Certification (CMMC), v.2.0, December, 2021

1. UMGC X-1.02 Data Classification
2. UMGC X-1.04 Information Security
3. UMGC X-1.18 Information Security Risk Management
4.  UMGC 366.10 Contract Review and Maintenance Procedures
5. UMGC 370.10 Procurement Policies and Procedures