1. Cloud Service Procurement: Engaging the CISO for a Risk Assessment
Walter Petruska
Information security officer
University of San francisco
Educause SPC May 5, 2015

2. Conversation Starter: Asking Questions
Is your CISO involved in the procurement process?
Do you have a CISO? Do you have a procurement process?
HOW is, or how SHOULD your CISO be involved?
Business Process – Coordination between key parties
Business Units / Schools
IT Organization – Operations and Project Management Office
Purchasing Organization
Legal / Contract review focuses on LEGALITY and completeness
Finance and Accounting (Registered Vendor / D&B report)
Risk Management staff including Insurance and Liability review
Finance- Periodic review of open-ended service agreements

3. Hypothesis: The Cloud is the Future
Trend data from Forrester and Gartner agree
Educause Top 10 #8: Mobile, Cloud, Digital Policy
HEISC #3: Develop effective Cloud 3rd Party Policy
Promised Benefits:
Quick implementation – Reap rewards earlier
Minimal internal support costs – Reduces ongoing expense
However- Critical questions are not asked or considered before signing agreements or starting service delivery with Cloud Services.

4. Generic Resources – Frameworks
Educause Security Guide - HEISC
Shared Assessments
Cloud Security Alliance (CSA) CCM
PCI - DSS
FEDramp Security Assessment Framework
Controls and Maturity:
ISO 27001
SSAE16
Internet2 Net+ solutions program

5. USF Process Documents and Authorities
Security Services VSA
3rd Party Data Release Agreement
SSN Release – via AVP of Human Resources
Accounting & Business Services Vendor Application
OGC Contract Review
Departmental Budget and Finance Managers - POs
Purchasing Review – Checklist of above items
Accounts Payable – Contract Management

6. Develop Policies AND Standards
Policy in a vacuum is oftentimes ineffective-
Communicate regularly with your key stakeholders
Providing consultative support as well as clear standards for assessment. – ITSM approach
Give guiding outcomes, provide sample language for each facet of the Technology initiative (Service/Platform/Resource)
VSA: Vendor Security Assessment (form)
Iterative – Required
Finance: Annual Vendor Scorecard

7. Conversation – Process – Assess – Communicate Standards - Monitor and Collaborate
Start the conversation early
Invite yourself – write yourself into a process
Build support – work together
Use Common Frameworks to guide the Assessment
Communicate customized technology standards and preferences to potential vendors to assure best fit
Continuously Monitor your agreements for changes
Maintain Vendor performance records
Collaborate outside of your organization> Educause

8. End Note
Note:
Several documents and framework examples referenced on slides contained within this PowerPoint file were demonstrated live during the conference session. These items are not included within this presentation due to file size, complexity or due to the sensitive nature of the Vendor Security Assessment questions or the Systems Architecture reflected or revealed by those items.
If you attended the session, and would like to receive a ‘generic’ version of these items,