| Policy Category | Policy Owner | Version Effective Date | Review Cycle | Last Reviewed | Policy Contact |
|---|---|---|---|---|---|
| X. Info. Governance, Security & Technology | SVP, General Counsel, and Chief People Officer | June 11, 2025 | Every 2 years | June 11, 2025 | Information Governance |
- Purpose
The Third-Party Vendor Security Management program, governed by the Information Governance Team, is an initiative to reduce the risk to University Data and computing resources from Third-Party Providers. Information Security collaborates with the Office of Legal Affairs, the Office of Procurement, the University Data Protection Officer (DPO), the University Records Manager, and other University departments to protect Information Technology Resources and digital intellectual property at the University.
The purpose of this Policy is to ensure that all vendors have appropriate controls to minimize risks that could adversely impact Confidentiality, Availability, and/or Integrity of the service or product. - Scope and Applicability
- This Policy applies to all University operations involving University Information or its Information Technology Resources.
- This Policy applies to all University Employees as well as adjunct faculty, Third-Party Providers to include Contractors, consultants, temporary Employees, and other third parties performing duties on behalf of the University.
- Definitions
Defined terms are capitalized throughout this Policy and can be found in the Information Governance Glossary. - Third-Party Management
- Initial Screening
- All University departments engaging third-party IT products or services are required to undergo a security risk review of the requested product or service.
- Based on the security review performed, the UMGC Information Governance Team will determine if a comprehensive security assessment will be required prior to entering into any agreement with the vendor.
- Comprehensive Security Assessment
- If required, the Third-Party Provider must complete a security questionnaire, known as the Higher Education Community Vendor Assessment Toolkit (HECVAT) and/or provide a copy of their most recent independent security audit or certification reports (i.e., SOC 2, ISO 2700x certification).
- The Information Governance Team will review the security assessment and determine whether the Third-Party Provider complies with the University security requirements. If the Third-Party Provider is non-compliant, compensating controls will need to be implemented and reassessed.
- Contracting Agreements
- Third-Party Providers that will store, process, or transmit Data must permit inclusion of UMGC standard security clauses and language in all relevant contracts, which addresses compliance with UMGC security policies, right to audit, right to access, right to monitor, and compliance with applicable regulations where feasible.
- Third-Party Providers that will store, process, or transmit High Risk Data must sign a Data Processing Agreement (DPA).
- Subsequent Reviews
- Security reviews for third-party providers will cover a single use case and are required upon a new solution acquisition, changes in scope or use cases for current solutions, changes in system design or controls, business transfer, merger, or acquisition, and upon the renewal of current solutions.
- Periodic review of a Third-Party Provider security posture and continued compliance will be conducted as needed, based upon changes in system use, design or controls, contract renewal or business transfer, merger, or acquisition.
- Initial Screening
- Exceptions
Exceptions to this Policy should be submitted to Information Governance for review and approval. If an exception is requested a compensating control or safeguard should be documented and approved. - Enforcement
- Any Employee, Contractor, or Third-Party Provider performing duties on behalf of the University with knowledge of an alleged violation of this Policy shall notify Information Governance as soon as practicable.
- Any Employee, Contractor, or other Third-Party Provider performing duties on behalf of the University who violates this Policy may be denied access to Information Resources and may be subject to disciplinary action, up to and including termination of employment or contract or pursuit of legal action.
- Standards Referenced
- Most recent versions:
- USM IT Security Standards
- NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”
- Cybersecurity Maturity Model Certification (CMMC)
- Most recent versions:
- Related Policies