1. Streamlining Vendor Risk Management with the HECVAT
PRESENTED BY:
Joanna Grama EDUCAUSE; Kim Milford REN-ISAC

2. Agenda Project inspiration and the “job to be done”
Phase I work and completion
Phase II deliverables and current status
Questions

3. Project Inspiration
Campuses are rapidly adopting cloud services and deploying software systems
Assessing the risk for cloud services and software systems as quickly as possible
Developing vendor risk management programs
Developing enterprise risk management programs
Too much to do to effectively do it all!

4. This is a big project--so it was divided into two phases.
The Job to Be Done
How to easily and quickly share work done in many institutions
Free up time & resources for critical information security functions
Create a forum/space to share and find existing shared assessments
Build on higher education information security community sharing
Ease vendor burden in assessment response
This is a big project--so it was divided into two phases.

5. Phase I Deliverable www.educause.edu/hecvat
Create a cloud services assessment questionnaire/template that can be used to surface a short executive summary for review & sharing.
Collaboration between Internet2, EDUCAUSE, REN-ISAC and its members.
The Higher Education Cloud Vendor Assessment Tool (“HECVAT” if you are cool)

6. ANSWER We provided a Manual [in the form of an “Instructions” tab]!
Read The * Manual!
PROBLEM No Directions + 100’s of Questions = Insufficient Vendor Responses
ANSWER We provided a Manual [in the form of an “Instructions” tab]!
Document Layout
General Info
Sharing Selections
Documentation
Company Overview
Safeguards
HECVAT
Kim
Image: accessed April 20, 2017.

7. Initially, there are four use case specific sections...
# of ?s
Summary
Third Parties* 4
When a vendor (third party) uses a third party to support their product it is important to document vendor security assessments, any legal agreements, and general use case information. Section requirement based on Qualifier.
Consulting* 11
Controlled through a Qualifier. Vendor assessments for consulting services only require only a subset of questions to be answered; the remaining become optional.
PCI DSS* 12
Controlled through a Qualifier. The PCI DSS section is required when PCI DSS regulated data is shared.
HIPAA* 32
Controlled through a Qualifier. The HIPAA section is required when PCI DSS regulated data is shared. The largest section.

8. Although pioneering and useful, the HECVAT’s scope is specific and it has some limitations
The tool is long and we recognize this could be cumbersome for low risk evaluations
Requires significant resources to properly digest and analyze vendor responses
May not be appropriate for vendor engagements using lower-level data classifications
Kim
Analysis - will take time to develop expertise to suss out the +s and -s. Once your internal experts develop a baseline, it will go faster.

9. Phase II Phase II started in March 2017 Deliverables include:
Feedback Gathering
HECVAT Lite
Crosswalk to standards
Sharing infrastructure/proof of concept
Joanna
HECVAT Lite Is the lite version a subset of the DATA Questions (rows ) in the current HECVAT? Is a lite version needed for “less complex” situations or to flag vendors/products where more review might be needed?
Feedback Gathering--What is the institutional experience in using the HECVAT
Crosswalk Work--Mapping to infosec standards as needed.
Expectations paper--Independent of the HECVAT or other tools, what types of information/documentation do we expect from cloud vendors re security and privacy?
Sharing infrastructure paper/proof of concept---This is the big kahuna deliverable

10. Deliverable: HECVAT Lite
The HECVAT is a mere 284 questions
This includes qualifying questions for HIPAA and PCI opt-in
The HECVAT Lite project is to create a very lightweight version of the HECVAT for use in special situations
Short on time? Short on personnel to review? Short on budget? Short on risk?

11. Deliverable: Crosswalk to Standards
Understanding how HECVAT questions compare to industry standards is useful
Did we mention, 284 questions? That is a lot to crosswalk.
Currently we are reviewing, ISO 27002:2013; NIST SP Controls; NIST SP Controls; NIST Cybersecurity Framework; CIS 20 Critical Security Controls (ver 6.1); HIPAA Security Regs; PCI DSS Regs
Joanna
Mapping to sub controls is probably an unreasonable expectation
Do we want to CSA CCM (which has mappings to other frameworks)? YES, we should
This is a big iterative process project

12. REN-ISAC Cloud Broker Index
The Cloud Broker Index provides an up-to-date index of participating vendors with links to their completed assessments. 
If a vendor is already listed in the CBI, security assessors at colleges and universities can utilize the posted assessment, saving time for both security assessors and service providers. 
If you’d like to see a vendor added to the Index, or if you have feedback, please contact us at and provide us with the vendor, the product, and contact information.

13. Internet2 Cloud Services
Enable cohesive cloud service administration, procurement, and orchestration for campuses
Enable enhanced community collaboration around cloud service evaluation and validation
Including HECVAT in NET+
Resource for sharing more security information

14. Questions for You Have you used the HECVAT?
Take our survey and share your feedback please!

15. Questions for Us?

16. Thank You!
Please be sure to complete the session evaluation so that we can improve our presentation next time!