FAQ

The Data Security & Privacy Appendix was not included in the vendor contract, what do I do?

The contract with the 3rd-party service provider has already been signed and the UCOP Data Security & Privacy Appendix was not included. How will this affect the vendor security assessment?

For all UC contracts involving third-party access to covered data, the University of California Office of the President (UCOP) requires the inclusion of the Data Security and Privacy Appendix. The appendix establishes baseline protection for the University in the event of a data breach. Campus units that engage with service providers to handle covered data must ensure the appendix is included in new contracts without edits.

For VSAP engagements that...

Can I self-register Fixed IP address assignments?

Department and Group Security Contacts can register devices for Fixed IP address assignment – where a device always gets the same IP on its primary subnet, but a Dynamic IP on any other subnet – provided that the Security Contact has a registered subnet, with an available IP address space, and a registered subdomain.

For details about registering devices for Fixed IP address assignment, please review the "Devices" page in the Socreg...

What email address should I use for my Security Contact?

A Security Contact has one email address that is used to receive security notices. The email address should reach multiple people either via a listserv, group address, or, ideally, a CalNet Special Purpose Account so that security incidents involving a department or group's IT Resources receive prompt attention. SPAs are CalNet IDs that can be shared by multiple users for collaborative purposes and are recommended for this purpose. See ...

Having identified a service with attractive functionality, how do I find out whether there are similar services available or in use on campus?

The best campus resource for this the IST Service catalog. Additionally, the IST Procurement department may be able to assist you in finding services that have already been purchased on behalf of the campus.

The contract has already been signed, what do I do?

My unit is contracting with a 3rd-party service provider for the handling of campus protected data. The contract has already been signed, should I still engage with ISO for a vendor security assessment?


Although there is less bargaining power with the service provider to address security concerns after the contract has already been signed, it is still a good idea to perform a vendor security assessment for service providers who are handling UC P3 or P4 data:

If the overall risk level is acceptable, the unit is assured that the vendor meets campus policy for the protection of...

Are vendor services available that have already been approved?

Are vendor services available to campus that have already been approved for UC P2/3 or UC P4 data?


There are several 3rd-party vendor services that are readily available to campus that have been approved for UC P2/P3 or UC P4 data. Campus units that adopt these 3rd-party services for the purpose of storing and sharing covered data can be assured that these vendors meet campus policy requirements.

Campus units that utilize these services for the handling of protected data should keep in mind that careful configuration and management of these applications is required to meet campus policy standards.

UC P4...

I have UC P2/3 data, what do I do?

My unit is contracting with a 3rd-party service provider to host campus UC P2/3 classified data. How can the vendor be assessed to meet campus security policies in the absence of ISO resources?


Units can ensure that 3rd-party service providers meet the campus data security policy requirements for the handling of UC P2/3 data through the following actions:

Be sure to include the UCOP Data Security & Privacy Appendix, required for all UC contracts involving 3rd-party access to protected data, without edits, in the service provider contract. This ensures baseline...

What do I do if I believe my system has been infected by Ransomware?

Signs your system may have been infected by Ransomware:

Your web browser or desktop is locked with a message about how to pay to unlock your system and/or your file directories contain a "ransom note" file that is usually a .txt file All of your files have a new file extension appended to the filenames Examples of Ransomware file extensions: .ecc, .ezz, .exx, .zzz, .xyz, .aaa, .abc, .ccc, .vvv, .xxx, .ttt, .micro, .encrypted, .locked, .crypto, _crypt, .crinf, .r5a, .XRNT, .XTBL, .crypt, .R16M01D05, .pzdc, .good, .LOL!, .OMG!, .RDM, .RRK, .encryptedRSA...

What is a "3rd-party service provider"?

What is a "vendor" or a "3rd-party service provider"?

A "vendor" or "3rd-party service provider" is an entity (e.g., a person or a company), separate from the University, that offers something for sale. The typical types of vendor services that require an ISO vendor security assessment are technologies used to store, process, and/or transport protected data on behalf of the University, such as:

Software as a Service (SaaS) providers - companies that provide hosted application services (e.g., Google bmail) Infrastructure as...

Who is responsible for my data?

By engaging with a service provider, you have the responsibility as the Resource Proprietor for ensuring compliance with laws, regulations and policies, including standards (UC Business Finance Bulletin IS-2 and IS-3).

For example, if notice-triggering data is...