1. Procurement Reviews Marty Desautels, Associate Controller
Jeff Gassaway, Information Security & Privacy Officer

2. Agenda What Did We Do Before? What Are We Doing Now?
Why Are We Doing This?
What Else Are We Doing?
So … What Does Bad Look Like?
The Evolving Questionnaire
Where Are We Going Next?

3. Definition: PII/ SPI
Personally Identifiable/ Protected and Sensitive Information

4. What Did We Do Before? CIRT and Martha Purchasing and Martha
UNM is Martha-less
Audit and GLBA, et. al
Speaking of Which …
Purchasing and Information Security & Privacy in Partnership

5. What Are We Doing Now?
Personally Identifiable/ Sensitive and Protected Information (PII/ SPI)
Contracts
Agreements
Business Data Sharing
PCards

6. Why Are We Doing This? Exercise Diligence
Comply with Regulatory and Contractual Requirements
Prevent ID Theft

7. What Else Are We Doing As Part of This?
Are the Privacy and Security Safeguards Sufficient for the PII/ SPI?
For Third-Party Products and/ or Services that UNM Procures and/ or Implements On-Site With Local/ Locally Verifiable Safeguards
For Third-Party Products and/ or Services that UNM Procures and/ or Implements that are Partially or Entirely Provided by the Third-Party with Vendor Provided Validated Safeguards

8. So … What Does Bad Look Like?
For Example …
What’s a Privacy Policy?
“What do you Need our Privacy Policy to Say?”
“Can You Help us Write our Privacy Policy?”
But, we have SSL!?
UNM has an Obligation to Verify Appropriate Safeguards are in Place and Effective
Administrative
Physical
Technical
Sometimes Vendors are just Bad

9. The Questionnaire*
*Not to Scale

10. Current Workflow*
*Not to Scale

11. Where Are We Going Next? Process Improvements Streamlining Workflows
SciQuest
Help.UNM
FastInfo 7486 With Links to the Most Current:
Procedure
Questionnaires
Additional Information

12. Preguntas?