SAMPLE Completed Vendor Risk Assessment Form

Vendor Name

Theoretical Vendor Name

Vendor Address

123 Fake Street, Glenside, PA 19038

Vendor Contact Name

Friendly Person

Vendor Contact Title

Super Helpful Vendor Employee

Vendor Contact Email

friendlyperson@theoreticalvendor.com

Vendor Phone Number

215-867-5309

Vendor Year of Incorporation

12/31/99

Submitting Department Name

Information Technology Support Services (ITSS)

Submitting Department Contact Name

Director of ITSS

Submitting Department Contact Email

helpdesk@arcadia.edu

Submitting Department Contact Phone Number

215-572-2898

Has the vendor completed and provided a Higher Education Community Vendor Assessment Toolkit (HECVAT)?

Yes, I will attach the completed HECVAT to this form.

When do you plan on implementing this new product/service?

12/01/21

Will this Vendor have access to Arcadia University data or require the implementation of software?

Yes, the vendor will have access to University data ONLY.

Describe the services being provided, including the institutional data the vendor will be able to access. Please be as descriptive as possible.

Theoretical Vendor provides a cloud-based tool that will allow us to create and manage tickets and workflows for the University. Students, Faculty, and Staff will have the ability to submit tickets by emailing the help desk, calling the help desk, or using the web portal to submit a ticket. Members of the IT team will be granted the appropriate agent-level roles to manage tickets assigned to them. The platform will also have the ability to create forms and workflows. There is the chance that an end-user might accidentally submit information such as a password in a ticket (we do not ask for this), but we will not explicitly ask for passwords or items such as social security number or payment information. We will sometimes ask for date of birth, powercampus ID, secondary/alternate email address, and other information in order to confirm the identity of a user. Internal University data such as processes, procedures, workflows, configuration changes, system issues and user issues/resolutions will live in this platform.

How will the system/service be deployed?

Cloud/Hosted: Installed and managed by the vendor or a third party.

Does this implementation require support from the Information Technology Department?

Yes

If implementation does require support from IT, please identify which group(s) need to be involved.

Infrastructure and Security

ITSS/Help Desk

Enterprise Applications

Are you aware of another vendor that provides the same or similar services?

Yes

Please list the vendors that provide the same or similar services

Other Vendor Name; This is another Vendor

How long will services be provided by this vendor?

2-3 years

Is there a current contract with the vendor?

No

Has the vendor provided any of the following security documentation? Please choose from the following

HECVAT

SOC 2

Information Security Policy

Please upload any documentation provided by the vendor.

Will the vendor store or transmit any of the following types of information?

Student

Staff

Faculty

Alumni

Please choose from the following data fields to be collected.

Name (First, Last)

Phone Number

Email Address

Date of Birth

Other Information (Provide Detail)

Please list and describe the 'other' data fields to be collected.

Information related to an issue being reported. Internal university information such as processes, procedures, workflows, configuration changes, system issues and user issues/resolutions will live in this platform.

What Data Classification does the data stored or transmitted fall under?

Level 2 - Sensitive

Approximately how many records will be shared with the vendor?

5000+

Will any data be processed, stored or transmitted outside the United States?

No

How will data be transmitted to the vendor?

Automated Data Feed

Form Completion

Other

Please describe the 'Other' transmission method.

Email; voice message

Is there a technology expenditure or investment required?

Unsure

Which of the following departments have been informed of the interest in using this vendor?

Office of General Counsel

Business Office/Operations

Finance

Information Technology

Information Security