Starting Your Relationship with ASU

Information Security Contract Language

All systems containing ASU data must be designed, managed, and operated in accordance with information security best practices and in compliance with all applicable laws, rules, and regulations. To diminish information security threats, the university has included language in the standard terms and conditions of our purchase contracts to set expectations between ASU and outside vendors. Please view the ASU Standard Terms and Conditions to review the information security contract language.

Vendor IT Risk Assessment Process

All staff and faculty at ASU are responsible for the security of university systems, including any technology that we install or use. Before third-party technologies which process or access university data or systems can be procured, a Vendor IT Risk Assessment of each product must be completed. This assessment identifies third-party IT risk and provides recommended mitigating controls to lower the overall risk to university users, systems and networks. This process relies heavily on industry security standards and vendor-provided documentation as the basis for the risk assessment.

A VITRA will be required for any free or paid software, including cloud computing services, or any other software to be installed on the ASU technology network. This includes when:

ASU is purchasing or leasing software, or processing a software license or subscription renewal.

A third-party entity is:

• Creating software code and providing it to ASU as licensed software purchased by ASU.
• Receiving, storing or analyzing ASU data; including data which is not online.
• Hosting, or managing by infrastructure outside of ASU, including in the cloud, ASU data.
• Collecting personal identifiable information or ASU data via a link on an asu.edu or another ASU-managed webpage.

Vendor Evidentiary Documentation

Depending on the nature of data and applicable integrations that your product is expected to handle at ASU, you may need to provide the following documentation, if you possess them:

Any industry-standard security self-questionnaire, preferring but not limited to:

• Educause HECVAT Full or Lite
• Shared Assessments SIG Questionnaire

Any industry-standard security compliance audits or certifications, including but not limited to:

• AICPA SOC 2 Type 2 or SOC 3 report or executive summary (SOC 2 and SOC 3 FAQs).
• ISO 27001
• NIST 800-53 or 800-171.
• Center for Internet Security Controls
• Cloud Security Alliance STAR
• FedRAMP
• CMMC
• HIPAA compliance audit, if HIPAA data is in scope.
• PCI DSS compliance audit or attestation or the details of your payment processor if you do not store or process PCI data yourself, if PCI data is in scope.

Any documentation on the vulnerability lifecycle of your product:

• Penetration testing or vulnerability scanning report or an executive summary listing the number and severity of findings.*
• Web application vulnerability assessment, scanning report or an executive summary listing the number and severity of findings; covering at least the OWASP Top 10 web application security risks.
• Documentation of your vulnerability patching process and lifecycle.
• Documentation of your secure software development life cycle.

*Only needed if you manage your servers. Not required if you are using server-less computing technologies — see below for more info about the shared responsibility model.

System architecture diagram or description:

• Fully qualified domain names, IP addresses, ports, protocols, and encryption used by your internet-facing servers that will communicate with ASU endpoints or users.
• Documentation on integration implementation, when applicable, including the level of permissions and authentication required.
• Ability of your product to integrate with single sign-on technologies such as  Central Authentication Service, Shibboleth/Security Assertion Markup Language, or Active Directory Federation Services.**
• If your product is hosted by an international cloud service provider, the ability to configure your product to only employ data centers located within the borders of the United States.

**If Shibboleth is available, we will ask if you are a member of the InCommon Federation (wiki).

Cloud Service Providers and You — The Shared Responsibility Model

Security audits, assessments, and certifications covering the infrastructure of your cloud service provider do not include the specifics of your product that you have created and are responsible for. This is known as the "shared responsibility model" and here are links to documentation on this topic, provided by a few common cloud service providers:  Amazon Web Services, Google Cloud Platform, Microsoft Azure.

Using the Vendor Portal within ASU’s ServiceNow Platform

The ASU VITRA process utilizes the Vendor Risk Management solution provided by ServiceNow and includes a simple Vendor Portal which you will access to provide documentation. Please watch this short 5-minute video to learn how you will use the Vendor Portal.