The purpose of this checklist is to mitigate risks associated with vendors providing Software as a Service (SaaS) or other third party hosted applications and data exchange services. Complete the checklist before these types of contracts are approved (signed) and attach it to the documentation provided to Legal Affairs, Purchasing and/or Information Technology. The requesting department and the receiving department should retain a copy of this verification for the duration of the contract and in accordance with document retention standards for current and future audits. Alternatively, direct us to your completed Higher Education Community Vendor Assessment Toolkit which may substitute for this form.

Contract Provision (Send to vendor) Vendor: _______________________________ Product: ________________________________	Included in Contract? Yes/No/NA? If No/NA, please explain. If Yes, please reference section.
A statement of work
Expected downtime and scheduled maintenance hours (e.g. scheduled maintenance for upgrades, backups, etc.)
Level of technical support and expected response time
Acceptable use policy
A statement that VSU retains data ownership (owns all data provided)
Protections against the release or transfer of that data
Description of specific steps that will be taken if a security breach occurs or is suspected including notification to VSU contract approvers
Guarantees that VSU will receive data back at the end of the contract or a description of how data are securely destroyed
Right to audit the security and privacy procedures implemented by the SaaS provider
Recovery time objectives
Prohibition of conflict of interest
Detailed responsibilities for both VSU and the service provider concerning data security, especially the sensitive data types listed below, at the at the point of data handoff, in transit, and at both entities.
If data and/or service provided is deemed sensitive or confidential additional requirements should include:
Contractual Evidence of Adherence to appropriate government or industry regulations (e.g. FERPA, HIPAA, SOX or PCI)
Contractual Evidence The data are protected during both transfer and storage
Contractual Evidence of Access to the data and subsequent reports are limited to individuals with a need to know
VSU retains the right to request details regarding encryption mechanisms and other security related details
VSU retains the right to request copies of previous related audit reports and/or verification of meeting industry standards or regulations (e.g. PCI certification, SOC 3 or SysTrust/WebTrust)

Signature: _______________________________________	Date: ___________________

Signed by (Please Print) ____________________________	Dept: ________________________________________

Phone Number:	___________________________________	Email: _______________________________________

The use of third party providers is not new. These providers have historically included service bureaus, contractors, and other outsourced operations such as dining services or bookstores. In recent years, the practice of using third party hosted applications has become prevalent. Valdosta State University (VSU) uses such applications in many of its operations including Student and Academic Affairs, Admissions, Financial and Auxiliary Services. Many of these services are classified as Software as a Service (SaaS). While SaaS products/services often offer rapid conception-to-production turnaround time they also inherit additional risks.

(Internal Use only) Cybersecurity Risk Ranking (select one): None Low Moderate High