Good Afternoon,
The following operating
instruction is available for review and comment. It is located on the P&P
review site at https://mnscu.sharepoint.com/sites/policy/SitePages/Reviews.aspx. Please log in using your [StarID]@minnstate.edu
and your regular password. All feedback and comments may be submitted and
viewed through this site.
Operating Instruction
5.23.1.14 Third Party Vendors
Summary: This new operating
instruction defines the business owner's requirements for evaluating the
security controls of third party vendors that provide a systemwide service that
handles, processes or stores protected, sensitive data.
Responses are requested
by Wednesday , May 29, 2018.
1 Minnesota State
2 Chapter 5 – Administration
3 Operating Instruction
4
5
6 Operating Instruction 5.23.1.14 Review of Third Party Vendors
7
8 Part 1. Purpose
9 To establish minimum requirements for the oversight and monitoring of any third party vendor
10 that provides a systemwide service that handles, processes or stores Highly Restricted or
11 Restricted data as defined in System Procedure 5.23.2 Data Security Classification and
12 Operating Instruction 5.23.2.1 Data Security Classification.
13
14 Part 3. Definitions
15 For purposes of this operating instruction, the following definitions apply:
16
17 Business Owner
18 Any Minnesota State employee responsible for ensuring due diligence prior to the
19 execution of a contract, managing the third party relationship, and monitoring service
20 delivery for compliance with federal and state laws, regulations, Minnesota State Board
21 Policies, system procedures, operating instructions, and/or contract agreements.
22
23 Service Organization Control (SOC) reports
24 Report(s) on a third party’s controls that are relevant to security, availability, processing
25 integrity, confidentiality or privacy, and the customer’s internal control over financial
26 reporting. These reports are intended to meet the needs of a broad range of customers that
27 need detailed information and assurance about the effectiveness of the third party’s
28 controls.
29
30 Statement(s) on Standards for Attestation
31 A regulation created by the Auditing Standards Board (ASB) of the American Institute of
32 Certified Public Accountants (AICPA) for defining how service organizations report on
33 compliance controls. This requires the management of the service organization to provide a
34 written assertion to the auditor that their description accurately represents their
35 organizational system. The organization’s system description consists of the services
36 provided by the organization and all operational activities that affect the service's
37 customers. In addition, the organization must also assert that their description honestly
38 describes their control objectives and the time period in which they are meant to be
39 evaluated.
40
Part 4. Due Diligence Prior To Contract or Agreement 41 Execution or Renewal
42 For any systemwide service provided by a third party vendor, prior to the execution or renewal
43 of a master contract, the security controls and data management practices of the vendor must
44 be reviewed to ensure Highly Restricted and/or Restricted data will be adequately secured. The
45 Business Owner shall conduct the review in consultation with the system office Information
46 Security, Risk, and Compliance department.
47
48 The Business Owner is responsible for obtaining any necessary review and approval of the
49 contract by system legal counsel, as required by Board Policy 5.14 Contracts and Procurements.
50
51 Part 5. Annual Review of Control Environment
52 The Business Owner shall consult with the system office Information Security, Risk, and
53 Compliance department to conduct an annual review of the controls, data management, and
54 security practices of the third party vendor.
55
56 To ensure the controls adequately protect Highly Restricted and/or Restricted data, the
57 following documents must be reviewed:
58 The original contract and any applicable addendums, exhibits, or attachments;
59 If available, the vendor’s Service Organization Control (SOC) reports;
60 Any other report that has been conducted by a third party that evaluated the third
61 party’s data management and/or security controls. This does not include the third party
62 conducting an internal evaluation of their own controls or practices.
63
64 The review must also include an evaluation of controls performed by Minnesota State that are
65 required by terms in the contract or agreement with the third party. If a SOC report is provided
66 by the vendor, the controls that must be implemented by Minnesota State will be identified in
67 the report as “complementary user entity controls.”
68
69 Part 6. Documentation of Annual Review
70 The results of the annual review of the control environment must be documented and retained
71 by the Business Owner in accordance with records retention schedules. Documentation must
72 include:
73 Business Owner name and title;
74 Vendor or company name, or the college, university or system office that is providing
75 the service;
76 Brief description of the service provided;
77 Date of original contract or agreement;
78 Any and all documents or reports (e.g., Service Organization Control reports,
79 Statement(s) on Standards for Attestation, etc.) that were included in the review
80 process;
Any deficiencies in the third party’s data management 81 practices – i.e., data backup
82 practices, comingling with other customers’ data, sharing data with other third party
83 entities, etc.;
84 Any deficiencies in the third party’s security controls, as identified by the system office
85 Information Security, Risk, and Compliance department;
86 Any deficiencies in Minnesota State’s security controls, as identified by the system office
87 Information Security, Risk, and Compliance department.
88
89
90
