FAQ
Click questions to expand answers.
ISPO Services
- Privacy, Compliance, and Risk Services
- Contract Review
- Data Sharing Agreement Review
- Institutional Review Board (IRB) Review
- PCI Compliance
- Other Privacy, Compliance, and Risk Services
- Information Security Services
- Continuous Vulnerability Monitoring
- Application Access Requests
- Application Maintenance and Support Requests
- Event Management
- Digital Forensics
- Firewall Change Requests
- Incident Response Services
- Information Security Incident Response Services
- Minor Incidents
- Major Incident
- Information Security Incident Response Services
- Information Request
- Operational Intelligence
- Event Management
- Event Log Analysis
- Penetration Testing
- Network Vulnerability Penetration Test
- Web Applications Penetration Test
- Vulnerability Assessment(s)
- Network Vulnerability Assessment
- Web Applications Assessments
- Other Information Security Request
- Continuous Vulnerability Monitoring
Please use Help.UNM or call the IT Customer Service Desk at 7-5757 to ensure that your request is opened, tracked, and processed in a timely manner. Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
Information Security Services
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
- Before submitting a request, we recommend you review: FastInfo #7263: How do I submit a request using Help.UNM Self-Service?
Privacy, Compliance, and Risk Services
- Please be advised, the ISPO requires a completed Preliminary Security Questionnaire (PIAQ) to begin process this type of request
- Before submitting a request, we recommend you review: FastInfo #7583: How do I initiate an Information Security Review for a contract or legal clause?
- Please be advised, the ISPO requires several pieces of information to process this type of request
- Before submitting a request, we recommend you review: FastInfo #5474: How do I submit a firewall rule change request?
- Please be advised, the ISPO requires several pieces of information to process this type of request
- Before submitting a request, we recommend you review: FastInfo #5474: How do I submit a firewall rule change request?
Purchasing Risk Assessment
About this Service
The Purchasing Risk Assessment service is driven by the University’s Data Privacy, Regulatory Compliance, and Risk Management obligations as they apply to the main and branch campuses. The purchasing risk assessment process is aimed at identifying risk as it applies to third-party access to the University’s information. In certain scenarios where it is determined sensitive information covered by contractual obligations, University Administrative Policies, and/or regulatory requirements, is being collected, stored, transmitted, or otherwise processed, a review of the appropriate business agreement and the vendor’s privacy policies and information security controls will be required. Similarly, on-premises use of third-party solutions or services may also require a further review of the in-scope system and of the respective vendor. Sensitive information includes, but is not limited to, Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), or Credit Card Information (PCI-DSS).
Procurement requests involving Purchasing Cards (PCards), Contracts, Requests for Proposal (RFPs), and other procurement methods shall be reviewed by appropriate enterprise or departmental information technology staff and the UNM Information Security & Privacy Office (ISPO). The University’s vendors are required to meet the contractual and regulatory obligations for the sensitive information they will have access, including, but not limited to:
- Banner ID (FERPA/HIPAA Identifier);
- Credit Card Information (regulated by the Payment Card Industry);
- Direct Deposit information (regulated by Federal Trade Commission);
- Institutional Review Board (IRB) activities;
- Protected Health Information (PHI) (regulated by Health Insurance Portability and Accountability Act – HIPAA);
- Social Security Number (SSN) (regulated by Federal Privacy Act of 1974);
- Student Grades and other academic records (regulated by Family Educational Rights and Privacy Act – FERPA);
- Student Loan information (regulated by Gramm Leach Bliley Act - GLBA)
Refer to University Administrative Policies 2000, 2030, 2520, 2550 and 2580 for additional information.
Healthcare/HIPAA related requests for the Health Sciences System (HSC) are reviewed by the HSC Information Security Office (HSC ISO). Please contact HSC-ISO for more information.
The purpose of a purchasing risk assessment is to ensure information for which the University is entrusted is adequately safeguarded.
Intake Process
The ISPO utilizes the University’s enterprise ticketing system Help.UNM and intake services provided by the UNM Information Technologies (IT) Service Desk, the University's central support organization for information technology-related services and computer-related issues. All information security-related events, incidents, and requests are forwarded to the ISPO by IT Service Desk staff. Please use Help.UNM to ensure that your request is opened, tracked, and processed in a timely manner. Requests submitted via email or channels not monitored by the IT Service Desk staff cannot be processed.
IT staff with internal access to Cherwell IT Service Management (Cherwell ITSM) must select the appropriate Record Type, Service Request Type, and Category, when generating a record, and must use the appropriate workflow when creating tasks for Cherwell teams. Additionally, IT staff are required to provide all the information outlined in the ‘Required Information’ section below. Requests that are not appropriately generated within Cherwell, or that do not include the minimum required information will be summarily cancelled/denied.
Please note, by the end of 2020 the intake for this service will be migrated away from Help.UNM to a Banner ERP workflow. Please periodically review this document to recieve notification of the planned change.
Required Information
Privacy Impact Assessment Questionnaire (PIAQ)
All Purchasing Risk Assessment requests must include an electronically completed and Privacy Impact Assessment Questionnaire (PIAQ), specifically the version intended for the UNM Purchasing Department. All PIAQs submitted during the purchasing risk assessment process must be reviewed and submitted by an applicable IT Officer or IT Liaison, or in some cases an IT Manager through Help.UNM. For more information, please reference the ‘Intake’ section above.
In the Privacy Impact Assessment Questionnaire (PIAQ), the requestor will be asked:
- Who is the business process owner the information or information system is intended to support;
- What is the applicable Purchasing Order (P.O.), Request for Quotes (RFQ), Request for Information (RFI), or Contract Number;
- What is the name of the vendor as well as the goods or services being procured;
- What is the request type (new, update, renewal);
- What information is being collected, stored, transmitted or processed;
- How the information or information systems will be used;
- The academic, administrative, or research purpose for the information or information systems;
- What individuals or groups will need to access the information or information systems;
- What locations where the information or information systems will be deployed;
- What locations from which to access the information or information system(s) is needed;
Data Owner or Data Steward Approval
In all scenarios involving sensitive information, written approval from the appropriate Data Owner or Data Steward must be obtained and submitted in the Help.UNM ticket. For questions regarding Data Stewards, please see the UNM Data Governance site located at this link. Please ensure the applicable Data Owner or Data Steward has provided their approval for your procurement request before starting the procurement process and before submitting a Purchasing Risk Assessment request.
Business Agreement(s) and Vendor's Privacy Policies
In all scenarios involving sensitive information, the ISPO shall review applicable business agreement(s) between the University and vendor, and the vendor's information privacy policies and procedures. At the end of the contract period, vendors must certify in writing that all UNM data was either returned to UNM in a form agreed to by UNM, or that all UNM information was destroyed. Please ensure that you have attained the appropriate documentation before submitting a Purchasing Risk Assessment request.
Higher Education Community Vendor Assessment Tool (HECVAT)
In all scenarios involving sensitive information, the ISPO may need to review the information security policies and procedures of the vendor. Additionally, a review of specific safeguards must be completed to comply with regulatory requirements. In such cases, the vendor must complete the Higher Education Community Vendor Assessment Tool (HECVAT). Please ensure you have attained the vendor completed HECVAT from your vendor before submitting a Purchasing Risk Assessment request.
Social Security Number Collection Reporting Worksheet (SSNCRW)
In all scenarios involving third-party (vendor) access to SSN, the requestor is required to submit a completed Social Security Number Collection Reporting Worksheet (SSNCRW). In such cases, the appropriate IT Officer, IT Liaison, or IT Manager must complete the SSNCRW.
Workflow
- Purchasing Agents shall contact their area’s appropriate IT Officer, IT Liaison, or IT Manager to assess a proposed purchase and collaboratively complete a Privacy Impact Assessment Questionnaire (PIAQ) with their IT contact. If and where necessary/required, the IT contact will know whether to collect additional information (i.e. Data Owner or Data Steward approval, business agreements, vendor privacy policies, vendor-completed HECVAT, department-completed SSNCRW, etc.).
NOTE: The IT contact is responsible for collecting all necessary information before submitting a request. For more information or to contact your IT Officer (ITO) please reference the following page: Get To Know Your ITO. - IT Officers, IT Liaisons, or IT Managers shall submit a Purchasing Risk Assessment request through Help.UNM after collecting all the necessary information outlined in the ‘Required Information’ section above.
- Data Owners or Data Stewards shall review proposed procurements that involve the data they are responsible for and shall provide written authorization to use said information (if necessary/required).
- The ISPO’s Privacy, Compliance, and Risk area shall review electronically completed PIAQs and ensure all appropriate documentation has been submitted.
- The ISPO’s Information Security Operations shall review the vendor's information security policies, procedures, and controls (if necessary/required).
Responsibilities
Purchasing Agents
Purchasing Agents are responsible for thoroughly reviewing this document and for coordinating communication between the departmental contact responsible for the business process a proposed procurement supports and the appropriate IT Officer, IT Liaison, or in some cases IT Manager.
IT Officers, IT Liaisons, and IT Managers
UNM-designated IT Officers, IT Liaisons, and in some cases IT Managers are responsible for thoroughly reviewing this document, coordinating responses to the Privacy Impact Assessment Questionnaire (PIAQ), collecting additional documentation if required (i.e. Data Owner or Data Steward approval, business agreements, vendor privacy policies, vendor-completed HECVAT, department-completed SSNCRW, etc), and for submitting a request on behalf of the applicable Purchasing Agent via Help.UNM.
Data Owners and/or Data Stewards*
UNM-designated Data Owners or Data Stewards are responsible for appropriately reviewing proposed procurements that involve all data they are responsible for.
ISPO - Privacy, Compliance, and Risk
The ISPO's Privacy, Compliance, and Risk area is responsible for reviewing all electronically completed PIAQ's submitted through Help.UNM, and where applicable reviewing additional documentation and contacting the ISPO's Information Security Operations team in the event a review of the vendor's information security policies, procedures, and controls is required.
ISPO - Information Security Operations*
The ISPO's Information Security Operations area is responsible for reviewing the vendor's information security policies, procedures, and controls if required.
*These areas are only engaged in limited scenarios
Questions and Feedback
If you have questions or feedback regarding this document or the Purchasing Risk Assessment service, please use Help.UNM or call the IT Service Desk at 7-5757 to ensure that your information request or feedback request is opened, tracked, and processed in a timely manner. The IT Service Desk will forward your request to ISPO staff.
Malware & Hacking
- Gather information about the event including the following:
- Date and time of the event
- Location of the event
- How you suspect the event may have occurred
- Isolate the affected machine by disconnecting the machine from a network (either wired or wireless), but do not power-off the machine, volatile (and valuable) data will be lost of the machine is powered-off
- After you have collected the relevant information, report the event by opening a Help.UNM ticket and by calling the ISPO on-call number (505) 277-2497
- First, disconnect from the network by turning off Wi-Fi and unplugging Ethernet
- Then, contact the IT Service Desk for help at (505) 277-5757
NetID Issues
Email Issues
- Please be advised, the ISPO uses automated tools to process spam submissions.
- For more information, see FastInfo #7929: What is Spam Email?
The University will never ask for your password to your NetID through email, even during a password reset. If you receive an email asking for your password, sensitive information, or personally identifiable information and you suspect that it is fraudulent, check the Phish Bowl for examples of phishing email and to see if the email has been reported to the ISPO. Phishing email found in the ‘Inbox’ folder can be reported using the ‘Report Message’ feature in Outlook.
- Please be advised, the ISPO uses automated tools to process phishing submissions.
- For more information, see FastInfo #7930: What is Phishing Email?
- Do not reply to the sender
- Use the ' Report Message' feature in Outlook to report the email
- Please be advised, the ISPO uses automated tools to process spam submissions.
- For more information, see FastInfo #7929: What is Spam Email?
- Do not reply to the sender
- Use the ' Report Message' feature in Outlook to report the email
- Please be advised, the ISPO uses automated tools to process phishing submissions.
- For more information, see FastInfo #7930: What is Phishing Email?
