Skip to main content

PS-7 Third Party Personnel Security

Description​

The university establishes personnel security requirements including security roles and responsibilities for third-party providers and monitors provider compliance.

Applicability​

  • This Control applies to all information resource owners and unit managers.

Implementation​

  • 1It is the responsibility of the information resource owner, or designee, to:

    • 1.1Establish and document personnel security requirements including security roles and responsibilities for third-party providers;

    • 1.2Require third-party providers to comply with personnel security policies and procedures established by the university;

    • 1.3Require third-party providers to notify unit managers of any personnel transfers or terminations of third-party personnel who possess university credentials, or who have information resource privileges within 72 hours; and

    • 1.4Monitor provider compliance.

      Related Resource

      Information Resources Contract Clauses: Vendor Access Language