About this Service

The Purchasing Risk Assessment service is driven by the University’s Data Privacy, Regulatory Compliance, and Risk Management obligations as they apply to the main and branch campuses.  The purchasing risk assessment process is aimed at identifying risk as it applies to third-party access to the University’s information.  In certain scenarios where it is determined sensitive information covered by contractual obligations, University Administrative Policies, and/or regulatory requirements, is being collected, stored, transmitted, or otherwise processed, a review of the appropriate business agreement and the vendor’s privacy policies and information security controls will be required.  Similarly, on-premises use of third-party solutions or services may also require a further review of the in-scope system and of the respective vendor.  Sensitive information includes, but is not limited to, Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), or Credit Card Information (PCI-DSS).

Procurement requests involving Purchasing Cards (PCards), Contracts, Requests for Proposal (RFPs), and other procurement methods shall be reviewed by appropriate enterprise or departmental information technology staff and the UNM Information Security & Privacy Office (ISPO).  The University’s vendors are required to meet the contractual and regulatory obligations for the sensitive information they will have access, including, but not limited to:

• Banner ID (FERPA/HIPAA Identifier);
• Credit Card Information (regulated by the Payment Card Industry);
• Direct Deposit information (regulated by Federal Trade Commission);
• Institutional Review Board (IRB) activities;
• Protected Health Information (PHI) (regulated by Health Insurance Portability and Accountability Act – HIPAA);
• Social Security Number (SSN) (regulated by Federal Privacy Act of 1974);
• Student Grades and other academic records (regulated by Family Educational Rights and Privacy Act – FERPA);
• Student Loan information (regulated by Gramm Leach Bliley Act - GLBA)

Refer to University Administrative Policies 2000, 2030, 2520, 2550 and 2580 for additional information.

Healthcare/HIPAA related requests for the Health Sciences System (HSC) are reviewed by the HSC Information Security Office (HSC ISO).  Please contact HSC-ISO for more information.

The purpose of a purchasing risk assessment is to ensure information for which the University is entrusted is adequately safeguarded.

Intake Process

The ISPO utilizes the University’s enterprise ticketing system Help.UNM and intake services provided by the UNM Information Technologies (IT) Service Desk, the University's central support organization for information technology-related services and computer-related issues.  All information security-related events, incidents, and requests are forwarded to the ISPO by IT Service Desk staff.  Please use Help.UNM to ensure that your request is opened, tracked, and processed in a timely manner.  Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.

IT staff with internal access to Cherwell IT Service Management (Cherwell ITSM) must select the appropriate Record Type, Service Request Type, and Category, when generating a record, and must use the appropriate workflow when creating tasks for Cherwell teams.  Additionally, IT staff are required to provide all the information outlined in the ‘Required Information’ section below.  Requests that are not appropriately generated within Cherwell, or that do not include the minimum required information will be summarily cancelled/denied.

Please note, by the end of 2020 the intake for this service will be migrated away from Help.UNM to a Banner ERP workflow.  Please periodically review this document to recieve notification of the planned change.

Required Information

Privacy Impact Assessment Questionnaire Questionnaire (PIAQ)

All Purchasing Risk Assessment requests must include an electronically completed and Privacy Impact Assessment Questionnaire (PIAQ), specifically the version intended for the UNM Purchasing Department.  All PIAQs submitted during the purchasing risk assessment process must be reviewed and submitted by an applicable IT Officer or IT Liaison, or in some cases an IT Manager through Help.UNM.  For more information, please reference the ‘Intake’ section above.

In the Privacy Impact Assessment Questionnaire (PIAQ), the requestor will be asked:

• Who is the business process owner the information or information system is intended to support;
• What is the applicable Purchasing Order (P.O.), Request for Quotes (RFQ), Request for Information (RFI), or Contract Number;
• What is the name of the vendor as well as the goods or services being procured;
• What is the request type (new, update, renewal);
• What information is being collected, stored, transmitted or processed;
• How the information or information systems will be used;
• The academic, administrative, or research purpose for the information or information systems;
• What individuals or groups will need to access the information or information systems;
• What locations where the information or information systems will be deployed;
• What locations from which to access the information or information system(s) is needed;

Data Owner or Data Steward Approval

In all scenarios involving sensitive information, written approval from the appropriate Data Owner or Data Steward must be obtained and submitted in the Help.UNM ticket.  For questions regarding Data Stewards, please see the UNM Data Governance site located at this link.  Please ensure the applicable Data Owner or Data Steward has provided their approval for your procurement request before starting the procurement process and before submitting a Purchasing Risk Assessment request.

Business Agreement(s) and Vendor's Privacy Policies

In all scenarios involving sensitive information, the ISPO shall review applicable business agreement(s) between the University and vendor, and the vendor's information privacy policies and procedures.  At the end of the contract period, vendors must certify in writing that all UNM data was either returned to UNM in a form agreed to by UNM, or that all UNM information was destroyed.  Please ensure that you have attained the appropriate documentation before submitting a Purchasing Risk Assessment request.

Higher Education Community Vendor Assessment Tool (HECVAT)

In all scenarios involving sensitive information, the ISPO may need to review the information security policies and procedures of the vendor.  Additionally, a review of specific safeguards must be completed to comply with regulatory requirements.  In such cases, the vendor must complete the Higher Education Community Vendor Assessment Tool (HECVAT).  Please ensure you have attained the vendor completed HECVAT from your vendor before submitting a Purchasing Risk Assessment request.

Social Security Number Collection Reporting Worksheet (SSNCRW)

In all scenarios involving third-party (vendor) access to SSN, the requestor is required to submit a completed Social Security Number Collection Reporting Worksheet (SSNCRW).  In such cases, the appropriate IT Officer, IT Liaison, or IT Manager must complete the SSNCRW.

Workflow

Responsibilities

Purchasing Agents

Purchasing Agents are responsible for thoroughly reviewing this document and for coordinating communication between the departmental contact responsible for the business process a proposed procurement supports and the appropriate IT Officer, IT Liaison, or in some cases IT Manager.

IT Officers, IT Liaisons, and IT Managers

UNM-designated IT Officers, IT Liaisons, and in some cases IT Managers are responsible for thoroughly reviewing this document, coordinating responses to the Privacy Impact Assessment Questionnaire Questionnaire (PIAQ), collecting additional documentation if required (i.e. Data Owner or Data Steward approval, business agreements, vendor privacy policies, vendor-completed HECVAT, department-completed SSNCRW, etc), and for submitting a request on behalf of the applicable Purchasing Agent via Help.UNM.

Data Owners and/or Data Stewards*

UNM-designated Data Owners or Data Stewards are responsible for appropriately reviewing proposed procurements that involve all data they are responsible for.

ISPO - Privacy, Compliance, and Risk

The ISPO's Privacy, Compliance, and Risk area is responsible for reviewing all electronically completed PIAQ's submitted through Help.UNM, and where applicable reviewing additional documentation and contacting the ISPO's Information Security Operations team in the event a review of the vendor's information security policies, procedures, and controls is required.

ISPO - Information Security Operations*

The ISPO's Information Security Operations area is responsible for reviewing the vendor's information security policies, procedures, and controls if required.

 *These areas are only engaged in limited scenarios   

Questions and Feedback

If you have questions or feedback regarding this document or the Purchasing Risk Assessment service, please use Help.UNM or call the IT Service Desk at 7-5757 to ensure that your information request or feedback request is opened, tracked, and processed in a timely manner.  The IT Service Desk will forward your request to ISPO staff.