Re: Purchasing Drones / 3rd party risk assessment

[Jackie Milhans <milhans () NORTHWESTERN EDU>]

It may be worth posting to the new “Remotly Piloted Aerial Systems” CG if you haven’t already: 
https://www.educause.edu/community/remotely-piloted-aerial-systems-rpas-community-group.

Regards,
Jackie



Jackie Milhans, PhD (she/her/hers)
Manager, Computing and Data Support Services
Research Computing Services
Northwestern Information Technology
Northwestern University
milhans () northwestern edu<mailto:milhans () northwestern edu>
(847) 467-4592



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of Pitt, Sharon 
<spitt () UDEL EDU>
Date: Wednesday, March 17, 2021 at 3:21 PM
To: SECURITY () LISTSERV EDUCAUSE EDU <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] Purchasing Drones / 3rd party risk assessment
No questions, but I will note that the Cybersecurity Maturity Model Certification (CMMC) could include drones as part 
of that review/assessment.  So, if/as you’re thinking about adhering to NIST800-171 for research..and as those 
requirements tighten, that might be a consideration.

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Martinez, Brian
Sent: Wednesday, March 17, 2021 4:17 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Purchasing Drones / 3rd party risk assessment

Hi all,

I was recently brought in on an initiative our Purchasing department is taking on regarding the purchasing of drones. 
We’re currently partnered up with Purchasing to screen and possibly further assess all technology purchases and we have 
a fairly generic screener form that gets the point across to us regarding general IT purchases.

With drones, obviously there are certain rules and regulations (and laws) that need to be followed. Our University also 
has a university-wide policy that must be adhered to. What I’m curious about though, is if any of you have specific 
questions you ask during the purchasing process at your respective institution regarding drones? If so, what are they?

Feel free to reach me off-thread if that’s best for you. Or if you have more questions or would rather chat about it, 
let me know – I’d be happy to avail myself to speak on this some. I’m still trying to figure out my exact role in this 
myself.

Thanks!

Brian R. Martinez
Information Security
Michigan State University
Office: +1-517-884-8791
brm () msu edu<mailto:brm () msu edu>


**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://urldefense.com/v3/__https:/www.educause.edu/community__;!!Dq0X2DkFhyF93HkjWTBQKhk!Bmfuz55POEpVAqYfBSFMaCFqcXZmLy8kqgQkEMfutmVuIT7OGDc0hnOPm9KQvACLfsB7$>

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://urldefense.com/v3/__https:/www.educause.edu/community__;!!Dq0X2DkFhyF93HkjWTBQKhk!Bmfuz55POEpVAqYfBSFMaCFqcXZmLy8kqgQkEMfutmVuIT7OGDc0hnOPm9KQvACLfsB7$>

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community