Re: IT Security in Purchases and Contracts

[Eric Galyon <Eric.Galyon () CUSYS EDU>]

Earlier this week I asked for information about specific IT security
language/practices other institutions require when negotiating
agreements with third parties.  Thanks for the responses and to the
institutions with publicly available information.  As promised, my
summery is attached.  Hope it saves someone out there a few hours of
work...

 

Thanks,

 

Eric Galyon

Technical Security Specialist

Office of Information Security

University of Colorado

(303) 492-9419

Eric.Galyon () cusys edu

 

________________________________

From: Eric Galyon 
Sent: Tuesday, September 04, 2007 8:37 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: IT Security in Purchases and Contracts

 

I've attempting to research Higher Education practices in extending
University IT security policies to contracts and purchases.  I'm
interested in speaking with any institution that has either:

 

1)  Created specific processes which enforce specific reviews and/or
approvals of IT security aspects prior to purchase authorization.

 

2)  Introduced specific written language into contracts, service
arrangement agreements, or RFPs requiring vendors to meet University IT
security policy requirements.

 

I'd be interested in knowing about institutions that have tackled either
of these issues; contact information would be a plus.  I'll gladly
summarize my results and post them back to this list for others.

 

Thanks,

 

Eric Galyon

Technical Security Specialist

Office of Information Security

University of Colorado

(303) 492-9419

Eric.Galyon () cusys edu

Attachment: SurveyOfHigherEdThirdPartyConfidentialityAgreements.pdf
Description: SurveyOfHigherEdThirdPartyConfidentialityAgreements.pdf