1. Confidential: University of California San Francisco Medical Center Situation and background Risks Opportunities Evaluation of candidates Security compliance Core requirements Cost analysis Project recommendation Asks/Questions/Decisions Next steps User acceptance testing Architecture approval Deployment Slide 0 Agenda – Secure Email Project May 1, 2014 UCSF Information Technology

2. Confidential: University of California San Francisco Medical Center Allows email with confidential information to be delivered securely outside of UCSF Primary users include: Health Care Providers Legal Department Finance Department Human Resources UCSF’s secure email system will be end of life and out of compliance on November 14, 2014 All existing functionality will be replicated in the new system There is no migration path for the current system; this provides an opportunity to evaluate leaders in the market Slide 1 Secure Email Project

3. Confidential: University of California San Francisco Medical Center Slide 2 UCSF Email Flow Vontu Data Loss Prevention Tumbleweed Secure Email Antivirus and SPAM Email Hygiene Email server External Recipient Secure Email Access SSL UCSF Firewall UCSF Departments/Users To: someone@external.comsomeone@external.com Subject : Secure: PHI stuff

4. Confidential: University of California San Francisco Medical Center Slide 3 Gartner - Secure Email Gateway

5. Confidential: University of California San Francisco Medical Center Slide 4 Five Year TCO FIVE YEAR TCO ANALYSIS CISCO IRONPORT CLOUD CISCO IRONPORT APPLIANCE AXWAY MAILGATE APPLIANCE AXWAY MAILGATE CLOUD Capital Expenses Appliance (Two for redundancy) $ 6,075.00 $ 22,800.00 Implementation services $ 6,000.00 $ 3,520.00 Fifth year appliance refresh (Two for redundancy) $ 6,075.00 $ 25,080.00 Perpetual Software License $ 14,100.00 Cloud Set Up Fee $ 7,500.00 Operating Expenses Hosting Fee (5 years) $ 57,375.00 Annual Software License (5 years) $ 55,220.00 $ 77,620.00 $ 91,520.00 $ 81,950.00 TOTAL $ 82,839.00 $ 117,390.00 $ 164,539.00 $ 186,064.00

6. Confidential: University of California San Francisco Medical Center Cisco IronPort Lowest TCO for either cloud or on premise solution Leads Gartner’s Magic Quadrant for secure email gateways Reduces risk of exposure from compromised accounts Meets all core requirements UCSF sender experience remains the same Slide 5 Secure Email Recommendation

7. Confidential: University of California San Francisco Medical Center 1.Please provide names of a few people who can assist with user acceptance testing. 2.Is the current Tier 3 classification correct? System recovery is 5 days, Recovery point is 24 hours Secure email can be queued for delivery once the system is recovered Alternative communications would be utilized during an outage 3.Should external accounts be maintained longer than 1 year? Secure messages are purged after 60 days Maintaining external login accounts may increase security risk Short expiration could lead to higher volume of calls to the service desk and general dissatisfaction Slide 6 Asks/Questions/Decisions

8. Confidential: University of California San Francisco Medical Center User Acceptance Testing Account creation and navigation of interface Test sending, receiving, forwarding and recalling Architecture Validate design and implementation plans Procurement & Deployment Engage professional services Produce documentation and appropriate messaging for the user community Slide 7 Next Steps...

9. Confidential: University of California San Francisco Medical Center Slide 8 Secure Email Timeline