Re: HECVAT Security Assessment Question

[Andy Hooper <hooper () QUEENSU CA>]

For RFPs we do two stages. All bidders complete about twenty fairly easy
questions. This gives enough information for a sense of the security
maturity. Once a preferred bid has been selected, we do more detailed
questions during the negotiation phase. That could result in adding work
items to the contract, or in the worst case, moving on to the next
preference. Security has very low weight in our RFP scoring, but as long
as price isn't weighted too high, then good security seems to be
generally associated with good function.

HECVAT doesn't have much on privacy. Are people using HECVAT doing
something separate for privacy and access-to-information aspects?

- Andy Hooper - IT Services - Queen's University -