Third Party Security Risk Assessments

The Information Security Control Requirements (ISCR) MGT1.1.2 control requires a risk assessment of specified cloud-based systems that host OSU data and are managed by a third party. This includes:

• New third party implementations
• Existing systems that have undergone a major change
• The university’s use of the system has changed. 

The following are examples that would necessitate an assessment:

• A business area is seeking to subscribe to a cloud software service.
• A previous assessment was conducted for a cloud service, but now the use of the system has evolved, and the business unit is seeking to store a higher data classification.
• An assessment was conducted for a cloud service, and the business unit is now seeking to integrate with other systems.
• The cloud service was previously assessed and is listed on Cloud Assessment Registry, but another area is seeking to use it in a very different manner.

For each assessment the Risk Management Team needs:

• A point of contact from the internal project team who can answer questions about how Ohio State intends to use the application;
• A point of contact with the vendor who can answer technical questions about the application; and
• The vendor’s Federal Employer Identification Number (EIN) also known as Federal Tax ID.

The Risk Management Team needs contacts who are willing and capable of answering questions about the system. Additionally, the use case and implementation plan must be well defined.

The person requesting the assessment is responsible for identifying contacts, as well as identifying who will be responsible for ensuring the Security Questionnaire is completed. The requestor is also expected to provide preliminary details about the use case, any deadlines and what type of assessment has already been completed or is planned.

Please note that this service only assesses the information security risks associated with online applications. The requester is still responsible for initiating contact with Legal Affairs, ADA and Purchasing.

The request will be assigned to a member of the Risk Management Team. They will communicate with the vendor, Security Coordinator for the university area, and stakeholders.

Recommendations are made about how to best implement the application to minimize identified vulnerabilities. 

A report is presented to the Assessment Working Group (AWG) which decides whether or not the level of risk is acceptable to the university. A detailed process map depicts the entire procedure.

​ONLY IT Directors and Security Coordinators may request an assessment. This is to ensure that the IT staff are aware of the request.

1. Login to ServiceNow.
2. Click Order Services.
3. Click IT Security Services
4. Click on Third Party Risk Assessment
5. Complete the requested information and click Submit

If you are unable to access or complete the request, please email the cio-itriskassessments@osu.edu for assistance.

When an urgent business dictates the need to implement a cloud-based system prior to the completion of a third-party risk assessment, the business unit does have the option to temporarily accept risk for implementing the system. Please note that this does not eliminate the requirement for a risk assessment. A detailed process document depicts the entire procedure.

• MGT1.1.2 (Risk assessment of third-party cloud-based information systems) Job Aid
• Risk Assessment Management Platform (RAMP)
• Data Security & Privacy Addendum (DSPA)