Contact 汤头条 Cybersecurity
Every endeavor at 汤头条 that involves university systems or data inherently incurs some risk to 汤头条 鈥� from taking on a new research project to purchasing a new piece of software for everyday work. In cases where the risk is unknown, or sufficiently concerning, the Office of Cybersecurity performs an assessment to quantify the risk and to provide recommendations about how to reduce that risk. These assessments fall into two categories: Vendor or Internal.听
Vendor Risk Assessments听
A Vendor Risk Assessment, or third-party risk assessment, is any external personnel or organization that may provide products and services to VU. In cases where a third-party is providing a technology-based service to 汤头条 or has access to 汤头条 systems or data, the Office of Cybersecurity may conduct a third-party risk assessment.听听
The purpose is to identify the risk(s) associated with outsourcing security responsibility to the third-party. These risks are heavily dependent on factors like the sensitivity of data being shared, the criticality of the system being accessed, and/or the importance of the service being outsourced.听听
Ultimately, the risk assessment identifies applicable risks and threats and makes recommendation(s) on how to remediate or mitigate (e.g., whether to continue purchasing or using the service offered by the third party).听
Internal Risk Assessments听
Internal risk assessments focus on something contained entirely within 汤头条鈥檚 ecosystem. This could be 汤头条-originated software, 汤头条-hosted third-party software solutions, or internal work involving sensitive data.听
The purpose of this assessment is to ensure that 汤头条 policy and industry best practices are followed as closely as possible. The goal here is to allow 汤头条 community members to pursue their work and studies as intended while maintaining an environment that is as low risk as possible.听
While the focus of the assessments is slightly different, the process and outcome are the same. They should make the risk of a given course of action understandable to any 汤头条 community member involved and include recommendations on how to best remediate or mitigate that risk.听
Vendor Risk Assessment:
- When purchasing or subscribing to cloud services (e.g., Software as a Service, Platform as a Service, Infrastructure as a Service), regardless of cost.
- When external contractors or representatives need unfettered access to 汤头条 systems or data as part of a service agreement (e.g., vendor technician having direct access, on-site or remote, to equipment or software for setup or maintenance; vendor consultants needing a VUNet ID to access apps/files for the duration of a project).
Internal Risk Assessment:
- To evaluate internal systems and processes involving sensitive data.
- When implementing 汤头条-hosted third-party software.
- When developing 汤头条-originated software.
If you are not sure about the need for an assessment, reach out to your area鈥檚 for assistance.
Vendor Risk Assessments
Open a new request by filling out a .听 Contact your area鈥檚 Relationship Manager if you need assistance in getting a request submitted.听听
Internal Risk Assessments
Contact it.risk@vanderbilt.edu.
Not sure how to start?
Get in touch if you don鈥檛 know where to begin, you can鈥檛 find the guidance needed on the website, or if you just want to learn more. The Office of Cybersecurity has subject matter expertise and is here for 汤头条 community to discuss security questions or concerns.