Laptop with encryption lock
Hook with information attached
Envelope with locked page icon
Phone with lock

Security Guides and Policies

Security Tools and Services

Search all tools and services using the search bar.

Security Review

Category: IT Security OIT - Categories Audience: Faculty Staff
Risk and Compliance team reviews applications, cloud services and business processes to reduce risk and meet compliance standards.
Request Security Review

Application and Cloud Services Assessment Process

Third party vendor applications and cloud services can present significant risk to the University. To mitigate the risk, the Risk and Compliance (RAC) team reviews the security of vendor organizations for server applications facing the internet, or services provided by a vendor that will have access to university confidential, or highly confidential data (including HIPAA, FERPA, and PCI data). This process is essential in minimizing legal issues during the negotiation of the IT Security language during the contract process.

Timeline: Please note, we complete requests in the order we receive them and timelines are dependent on the responsiveness of the requestor, vendor, and the complexity of the agreement.

Risk and Compliance Process

  1. Go to the Requestor Questionnaire. (Form works best in Chrome and Firefox)  *Additional steps may be needed. See other team information below.
  2. Vendor Interaction - RAC team sends out vendor questionnaire and reviews to determine next steps.
  3. RAC team provides assessment results to the requestor.
  4. If approved, RAC sends approval email to the requestor and all interested parties. (PSC, ORC, and Data Integration contact).
  5. Contract Negotiations and Language - The RAC team works with the PSC to negotiate the IT Security language for the contract. 
  6. Exceptions to this process is the Security Risk Acceptance signed by Data Owner.

Other University Teams to Contact for Process

  • Procurement Service Center (PSC) - The team that will assist you with your purchase.
  • Data Integration Requests - If your request will include the integration of your software with CU System to retrieve university data, enter a data integration request as soon as possible.
  • Office of Regulatory Compliance (ORC) - If your request involves HIPAA data, the Office of Regulatory Compliance will be asked by the PSC to prepare a BAA for both parties to sign.


Let Us Know

See information on the OIT website that needs updating? Let us know!

OIT Website Update Request